CauseSignal: A Governed, Evidence-First Architecture for Software Incident Investigation

Software incidents are investigated through fragmented evidence distributed across observability systems, source repositories, databases, requirements, ticketing platforms, deployment records, documents, tests, and prior incident knowledge. This fragmentation increases investigation time and makes AI-generated conclusions difficult to verify. CauseSignal is a governed, evidence-first investigation architecture intended to coordinate these sources within one bounded, durable investigation state. The system uses predefined domain loops that can exchange scoped evidence requests while preserving provenance, currentness, trust classification, authority, and explicit limitations. Models may assist planning, interpretation, and summarization, but they do not grant themselves tools or authority, and derived summaries do not replace original evidence. This paper presents the problem formulation, architecture, evidence model, investigation lifecycle, governance controls, representative workflow, evaluation approach, and current limitations of CauseSignal. The central design claim is that trustworthy incident analysis requires an evidence control plane—not merely a generative model attached to telemetry.