Investigating a trace

IMPLEMENTED in 0.5.0. Investigation is a Workstation product interaction. It arranges evidence the trace already contains; it never creates evidence, changes a Build or design, or grants authority. Nothing here is a SEIF Protocol concept.

Where it is

Observe → select a trace. Above the layer table:

• Ask about this trace — type a question such as "Why did the agent receive the escalation policy?" and press Enter.
• Four investigations, one click each:

All trace evidence returns to the complete, unarranged trace view. The ordinary view is always one click away; the investigation view is never the only way to reach product truth.

Typed questions

A typed question is interpreted in two independent, local steps:

1. Routing picks one of the four investigations from the words in the question (missing, stale, didn't → missing or stale; build, changed, regression, deploy → Build; model, sent, prompt, consumed → what reached the model; otherwise → why it was included). The answer card says Interpreted as …; if that is wrong, one click on another investigation corrects it.
2. Subject matching looks for the layer or material the question names. Words are weighted by how few candidates contain them, so escalation identifies Escalation policy while support, which appears in many names, counts for little. A tie or no match names nothing. A named subject appears first with its layer decision, currentness, consumption state, exact source revision, Open current source → and Inspect current rule →.

Subject matching never leaves the machine.

From evidence back to the design

Inspect current rule → and Open current source → open today's editable design for the layer or source, with the trace's consumer and objective. When the trace came from Send test request, the same Context Test input is loaded, so the preview reproduces the request; an application's input may be absent under its retention policy and is never guessed. The Inspector shows Current design · historical trace unchanged and ← Return to trace evidence. Inspect responsible Build → opens the Build whose reference and full digest match the trace — never a same-named or latest Build — and, when the project has a newer Build, What changed in …? compares them. Changed rows in a Build comparison lead back to the current rule or source.

Typed decision providers

A provider may decide presentation only: which investigation a typed question asks for, and which application-owned evidence panels to show first.

ITypedDecisionProvider.Decide(InvestigationState, DecisionCall) → InvestigationDecision(Goal, Panels, Confidence?)

InvestigationDecision has no action, URL, command or code field. Panels and goals are application-owned enums; the application renders, authorizes and acts. A decision cannot execute, approve, promote, deploy or edit anything.

The composer validates every answer — known goal and panels, no duplicates, at most six panels, finite confidence in [0, 1], at least 0.65 for non-local providers, and a provider may never replace an investigation the user chose — under a 4-second limit. Anything else falls back to local rules with an explicit reason on screen: Decision provider unavailable, timed out, rejected the credential, Invalid composition, Insufficient decision confidence, Provider changed the requested investigation, or Question looks like it contains a credential; it was not sent. Provider error bodies never reach the screen. Confidence is labelled as describing the interpretation, not the evidence.

Explicit investigations never call a provider — the user already decided. Providers are consulted only for typed questions, the one unstructured input on this surface.

Providers

The TypeSafe adapter is enabled only by an explicit operator choice — both SEIF_DECISION_PROVIDER=typesafe and TYPESAFE_API_KEY (optional TYPESAFE_BASE_URL, TYPESAFE_DEFAULT_MODEL, default jev-latest). A key set for another tool sends nothing. It calls POST /v1/systemone with two choice questions (investigation, lead) whose labels are the application's own options, orders panels by the returned label probabilities, and uses the investigation answer's confidence.

What it sends, exactly (from the acceptance run; providerPayload in the proof):

{"model":"…","state":{"question":"Why did the agent receive the escalation policy?","requested_investigation":null,
 "trace":{"layers":"many","rendered_layers":"a few","unknown_layers":"a few","stale_exclusions":"one","budget_trimmed_layers":"none",
          "consumption":"not reported","content_retained":"yes","build_available":"yes"}},
 "questions":{"lead":{"type":"choice","criteria":{"selection":"…","sources":"…","currentness":"…","delivery":"…","build":"…","budget":"…"}},
              "investigation":{"type":"choice","criteria":{"explain_delivery":"…","missing_or_stale":"…","verify_consumption":"…","build_responsibility":"…"}}}}

Never sent: trace content or rendered messages, trace/Build/deployment identifiers, digests, layer ids, source names, locators, material titles, endpoints or credentials. Counts travel as words (none, one, a few, many) because the vendor's own UI library reports that Jev is unreliable on raw numbers. A question matching a credential pattern (the engine's secret patterns plus apikey-…) is refused before any request. The answer card lists the fields sent — or, after a failure, the fields offered, since the provider may not have received them.

Research basis

Read from primary sources on 2026-10-09:

• TypeSafe JavaScript SDK — typesafe-ai/typesafe-sdk-js at 66880ccd, package @typesafe-ai/sdk 0.6.0. systemOne({state, questions}) → POST /v1/systemone with a Bearer key; questions are noul (yes/no; answer noul = probability of yes), choice (answer: choice, confidence, probabilities per label) and score (ordered rubric; expected score, confidence, probabilities, legend); several questions are answered in one call over one state; responses carry model and token usage; default model jev-latest, 10 s per attempt, retries on 408/429/5xx.
• jev-ui — etweisberg/jev-ui at 42984d88: Branch (choice + fallback), Rank, Gate; "the judgment picks presentation; code owns actions", thresholds and fallbacks stay in application code, all judgments in a render pass share one request, telemetry is projected into words.
• jev-design-test — bhaiG-de/jev-design-test at 2c794ef6: a prompt bar selecting among an application-owned catalogue of UI blocks.

The adapter is built from the SDK's types and wire contract, not from marketing claims. No vendor benchmark is used anywhere in this product's proof.

Verdict and measurements

Fit: architecture ready, not product-proven. On this surface the trace facts are already typed, so deterministic arrangement is exact, private, free and immediate. The only place a typed decision could add value is interpreting free-text questions, where it might route paraphrases better than keywords. That is unmeasured: no TypeSafe credential exists in this environment, and none was created or bought.

Measured on our workload with the installed app (exact values for each release: proofs/product-experience.json beside its attestation):

Routing fixture: 30 phrasings labelled by the implementing agent, 30/30 routed as labelled. The router was written alongside those labels, so this guards intended coverage and regressions; it does not measure how well routing generalizes. Jev latency, cost, confidence distribution and routing quality: NOT_MEASURED.

To evaluate Jev: set both variables, ask the fixture questions plus human-written ones the router has never seen, and compare routing accuracy, latency and usage tokens with local rules. Keep it only if it measurably improves routing on held-out questions.

Historical workspace (0.6.0)

The new Historical investigation entry in Observe extends this question-based view. At the time, Now & compare, Reproduce and Improve share one execution coordinate. Full Build identity and source bytes come from the verified original artifact. Current rule/source navigation remains clearly labelled. Material presence alone means material known; the SubjectCard uses the explicit material rendered observation, with UNKNOWN when absent. Selection, materialization, projection, rendering and reported consumption remain different facts.

See Historical investigation and reproduction for the guided incident-to-test workflow, exactness criteria and unavailable-content states. External application input is optional under explicit content retention; it is never guessed from a summary.