root-cause-analysis

# Root Cause Analysis

Symptom → hypothesis formation → evidence gathering → elimination → root cause → verified fix.

<when_to_use>

- Diagnosing system failures or unexpected behavior
- Investigating incidents or outages
- Finding the actual cause vs surface symptoms
- Preventing recurrence through understanding
- Any situation where "why did this happen?" needs answering

NOT for: known issues with documented fixes, simple configuration errors, guessing without evidence

</when_to_use>

<discovery_phase>

## Core Questions

| Question | Why it matters |
|----------|----------------|
| What's the symptom? | Exact manifestation of the problem |
| When did it start? | First occurrence, patterns in timing |
| Can you reproduce it? | Consistently, intermittently, specific conditions |
| What changed recently? | Deployments, config, dependencies, environment |
| What have you tried? | Previous fix attempts, their results |
| What are the constraints? | Time budget, what can't be modified |

## Confidence Thresholds

| Level | State | Action |
|-------|-------|--------|
| 0-2 | Symptom unclear or can't reproduce | Keep gathering info |
| 3 | Good context, some gaps | Can start hypothesis phase |
| 4+ | Clear picture | Proceed to investigation |

At level 3+, transition to hypothesis formation. Below level 3, keep gathering context.

</discovery_phase>

<hypothesis_formation>

## Quality Criteria

| Good Hypothesis | Weak Hypothesis |
|-----------------|-----------------|
| Testable | Too broad ("something's wrong") |
| Falsifiable | Untestable |
| Specific | Contradicts evidence |
| Plausible | Assumes conclusion |

## Multiple Working Hypotheses

Generate 2-4 competing theories:
1. List each hypothesis with supporting/contradicting evidence
2. Rank by likelihood (evidence support, parsimony, testability)
3. Design tests to differentiate between them

</hypothesis_formation>

<evidence_gathering>

## Observation Collection

| Category | What to Gather |
|----------|----