← All docs

Reading an incident

What each field means, and what approving actually does.

Root cause and confidence

The root cause is a hypothesis, grounded in the evidence shown below it on the same page. The confidence rating is the model's own assessment of that hypothesis given the context it had — low is a legitimate and useful answer, and usually means the context was thin. Treat a low-confidence hypothesis as a starting point for investigation, not a conclusion.

The gathered context is shown alongside deliberately. If a connector was unreachable, or an organisation has no GitHub connector at all, that is visible in the context rather than hidden — the analysis was made without that input, and you should weigh it accordingly.

The proposed fix

A code_pr fix has a draft pull request. A commands fix is a list of shell or kubectl commands, stored as text and displayed. There is no code path in Incident Copilot that executes them; running them is your decision and your action.

A fix type of none means the model did not have enough to go on. That is a real answer, not a failure — it is much more useful than a plausible-looking guess.

Statuses

Triage: analysed, nothing awaiting a decision. Awaiting approval: the analysis identified a CI/CD pipeline that needs to run, so it is waiting on a person. Resolved: a human approved it and took it on. Dismissed: closed without approving — a false positive, a duplicate, or an analysis you disagree with.

What Approve does

It records that you approved this analysis, stamps who and when, and writes an append-only audit entry. It does not run the commands, merge the pull request, or start any pipeline — Incident Copilot has no ability to do any of those things. Approving is a signature, not an execution.

The audit entry explicitly records that nothing was executed, so the trail can never be misread later as "approved, and therefore applied".