downtime_root_cause_live
Read-only
Automatically diagnose downtime root causes by gathering live evidence from your endpoint—sampling tags, checking dataflow, and retrieving active alarms during the incident window.
Instructions
[READ][risk=low] AI downtime RCA copilot that GATHERS its own live evidence.
Same advisory, read-only, evidence-cited contract as downtime_root_cause — but
instead of hand-injecting evidence you give an endpoint + incident window and it
pulls the evidence itself: a cross-protocol diagnose_dataflow probe, a short
sampled series per ref (so flatline/bad-quality/anomaly surface via tag_health),
and active OPC-UA conditions. Light read load; non-destructive; nothing executed.
The gathered bundle is echoed under 'collected_evidence' (no hidden inputs).
Args:
endpoint: Endpoint name from config (any protocol). Omit for the default.
window: {start (ISO-8601), end?, asset?, category?, freshness_threshold_s?}.
refs: Tags/nodes/addresses to sample for this incident (first is also the
diagnose_dataflow target). Capped at 20.
sample_count: Reads per ref to build its series (1..60, default 8).
interval_ms: Delay between reads (>=50ms, default 200).
include_alarms: Surface active OPC-UA conditions as alarm evidence (OPC-UA only).
lead_window_s: Causal lead window before onset (default 300s).
include_graph: When true, also return the 'graph' block (same {nodes, edges,
mermaid, meta} causal-graph re-projection as downtime_root_cause). Pure
re-shape of the verdict; no new reasoning. Omit for the flat verdict.
Returns dict: same shape as downtime_root_cause plus 'collected_evidence'
{endpoint, protocol, refs_sampled, alarms_found, dataflow_verdict}.
Example: downtime_root_cause_live(endpoint="line1",
window={"start":"2026-06-28T10:00:00Z","asset":"line1"},
refs=["ns=2;i=5","ns=2;i=6"]).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| refs | No | ||
| window | No | ||
| endpoint | No | ||
| interval_ms | No | ||
| sample_count | No | ||
| include_graph | No | ||
| lead_window_s | No | ||
| include_alarms | No |