Purpose
One repeatable case structure.
Audit Mode turns available records into readable accountability cases. Each case separates measured evidence from interpretation, known facts from unknown gaps, and follow-up actions from general guidance.
Core principle: Observa reconstructs what available records support. It does not infer, estimate, or extrapolate beyond the source evidence.
Core case object
What an Audit Mode case contains.
{
"case_id": "OBS-DEMO-2026-001",
"case_title": "Logging Output Path Flapping",
"time_window": { "start": "2026-06-22T15:48:00Z", "end": "2026-06-22T15:57:00Z", "precision": "approximate" },
"system_component": "agent host / system logging / file-output actions",
"status": "evidence_path_degradation",
"confidence": "medium",
"summary": "The host remained reachable, but logging output actions repeatedly suspended and resumed.",
"known_facts": ["Disk space was available.", "Inodes were available.", "Logging file-output actions repeatedly suspended and resumed.", "The host remained reachable."],
"unknowns": ["Exact root cause of the logging suspension.", "Whether specific log files failed to receive messages.", "Whether important application logs were missed during the degraded window."],
"evidence_ids": ["EVID-007", "EVID-008"],
"observa_flags": ["record_integrity_risk", "evidence_path_degradation"],
"follow_up_items": ["Confirm logging service status.", "Inspect log directory permissions and log rotation state.", "Verify whether key service logs were written during the affected window."],
"section_a_measured": true,
"section_b_guidance": false
}
Required fields
Field reference.
case_id
Stable case identifier.
case_title
Human-readable title.
time_window
When the event or review occurred.
system_component
System, workflow, agent, or component involved.
status
Current case classification.
confidence
Strength of reconstruction.
summary
Short readable explanation.
known_facts
What the records support.
unknowns
What remains unresolved.
evidence_ids
Evidence references used by the case.
observa_flags
Audit flags raised.
follow_up_items
Owner-review actions.
section_a_measured
Whether this claim is measured from records.
section_b_guidance
Whether this claim is general guidance.
Allowed values
Status.
baseline_no_exceptionhealthyneeds_reviewevidence_path_degradationaccess_path_degradationrecord_integrity_riskblocked_actionmissing_approvalmissing_evidenceunknown_root_causeresolved
Confidence
High
The evidence directly supports the case.
Medium
The symptoms are clear, but root cause or impact is not fully confirmed.
Low
The records suggest a possible issue, but evidence is incomplete.
Evidence object
Each evidence item is referenced separately.
{
"evidence_id": "EVID-007",
"evidence_type": "journal_output",
"source_label": "Sanitized host journal output",
"source_path": "redacted",
"captured_at": "2026-06-22T16:00:00Z",
"sensitivity": "sanitized",
"notes": "Repeated logging output suspend/resume messages."
}
Allowed evidence types
journal_outputtest_outputgit_historyshell_historygovernance_reportjson_inputmarkdown_reportoperator_notesystem_statussanitized_excerpt
Allowed Observa flags
The signals a case can raise.
record_integrity_riskevidence_path_degradationaccess_path_degradationapproval_gapmissing_evidencemissing_ownerunknown_root_causeblocked_actionhealthy_baselineno_exception_detected
Section A / Section B rule
Measured evidence and general guidance never mix.
Section A — Measured
Reconstructed from records. If a claim is measured from evidence, it belongs here.
Section B — Guidance
Advice, interpretation, or general best practice. Not measured from records.
This separation keeps evidence-backed reconstruction distinct from general recommendations. Audit Mode must not blend the two.
Design principle
Every case states six things.
- What happened.
- What is known.
- What is unknown.
- What evidence supports the case.
- What needs owner review.
- What should not be overclaimed.
Boundary
Observa documents what happened and how it was reviewed. It supports accountability and compliance review; it does not certify compliance, replace legal review, or infer beyond available records. This is a draft schema for an early public artifact.