submit_case_evidence
Record one retrieved VMware fact as case evidence after a read-tool call, capturing raw payload, source, and summary to grade hypotheses and build the timeline.
Instructions
[WRITE] Record one retrieved fact — steps 02/03 of the evidence loop.
WHEN: after every read-tool call you intend to reason from.
RETURNS: {case_id, evidence_id, payload_events, payload_note, grade, reasons} — the resulting grade, so you need no second call to see whether this changed anything, and what the payload was read as, so a summary submitted in place of a result is visible here rather than as a zero from record_case_timeline later.
GOTCHAS: a fetch that failed or came back empty goes to record_case_gap, not here.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | The exact parameters the tool was called with, so it can be re-run. Omit only if there genuinely were none. | |
| case_id | Yes | The case this fact belongs to (from open_case/list_cases). Required. | |
| payload | No | The read tool's RAW result, not a summary. For its events to reach record_case_timeline it must be a list of event dicts, or carry them under 'items', 'events' or 'rows'. What was found comes back as payload_events/payload_note. | |
| summary | Yes | What this item shows, one line. | |
| falsifies | No | Hypothesis ids (H1, H2, …) this observation RULES OUT — the only route to Excluded; "we looked and found nothing" is a gap, not an exclusion. Ids must already exist via record_case_hypothesis; an unregistered id is refused and nothing is written. | |
| fetched_at | No | When the fetch happened, ISO-8601. Omit to stamp now — wrong for an item transcribed from earlier. | |
| window_end | No | End of the period the data covers, ISO-8601. | |
| source_tool | Yes | The tool within that skill, e.g. "get_events". Required, non-blank — "monitor said so" is not reproducible. | |
| time_source | No | Whose clock stamped it — "vcenter", "host" or "client". Recorded so a reader can judge whether two sources' timestamps compare; nothing in this release corrects for it. Null when unknown, never a guess. | |
| clock_skew_s | No | Known offset of that clock from UTC, in seconds. Recorded, likewise not applied. Null when unknown. | |
| source_skill | Yes | The skill that produced it, as the family spells it — "vmware-monitor", "vmware-aria", "vmware-log-insight". Required, non-blank. Two items from the SAME skill count as ONE source when corroboration is counted, so this string decides whether the case can reach Probable. Two reserved values name the knowledge layer instead: "knowledge-kb" and "knowledge-sr", the only sources that can be decisive. | |
| window_start | No | Start of the period the DATA COVERS, ISO-8601 — not when it was fetched. get_events(hours=24) run at 10:00 and at | |
| knowledge_entry_id | No | Which mounted knowledge entry this item IS. REQUIRED when source_skill is knowledge-kb or knowledge-sr — without it the entry's applies_to cannot be checked, so it counts as ordinary support and can never make the case Confirmed. get_case_knowledge lists what is mounted. |