Platform / Architecture
Three attempts. Each one knows what it is allowed to claim.
The cascade exists so that certainty is not manufactured. A tier that cannot meet its own criteria hands the question up rather than answering it approximately.
The cascade
What each tier does, and what stops it.
Tier 1 · Rules
Explicit WHY traversals encoding failure patterns your experts already recognise. No statistics. If the pattern matches, the answer is exact and the label is CONFIRMED.
A null metric, a sample below the floor, or no matching branch. The miss becomes the spec for the next tree.
Tier 2 · Causal model
A fitted graph attributes the anomaly across candidate causes, with confidence intervals and a residual. The confounder check runs before attribution, not after.
Explained variance below 70%, or the top two intervals overlapping. Uncertainty is not rounded away.
Tier 3 · Constrained LLM
A structured payload in, at most three ranked hypotheses out, each with a falsification test. Forbidden from naming a cause or emitting a figure.
Inability to produce a falsification test. If this tier is the common path, the graph is underspecified.
Tier 3 can never name a cause because naming a cause is a claim about the world, and this tier has no evidence — only language. It is allowed to propose what would settle the question, and nothing more.
Traversals live in configuration
A new pattern is an insert, not a deployment.
Traversal trees and the causal graph are rows in a table, not code. A domain expert who recognises a failure pattern can encode it, have it reviewed, and see it live without a release.
That property is what makes the system extend at the speed of the people who understand the domain, rather than the speed of the engineering backlog. It also means every pattern has an author, a date and a review — all of which appear in the audit record when that traversal decides something.
Testability
Deterministic where it can be, measured where it can't.
Tier 1 is unit-testable.
A traversal is a pure function over a metric set. You assert on it in CI, the same way you assert on any other business rule.
Tier 2 has numeric stopping criteria.
Explained variance, interval overlap and residual thresholds are assertions, not judgements. A regression in fit shows up as a failing check.
Tier 3 is schema-constrained and guard-checked.
Its output is validated against the payload it received. A number or a causal claim that was not in the payload is a rejection, not a warning.
Next
Then read what the guard does with all three.
Every conclusion from every tier passes the same shared checks before an agent sees it.