Investigations

An investigation looks for what explains a problem. When a change you track makes a measure worse, Morse offers one — you decide whether it runs. When a Reliability alert fires, Morse also starts one by itself if the Investigator is on for your organization. Either way it reads one agent’s runs in one environment — pulling in infra signals, a baseline comparison, recent deploy revisions detected from trace metadata, sample failed traces, and correlated alerts — and hands you back an AI-generated hypothesis, the model’s own confidence rating (high, medium, or low — a self-assessment, not a calibrated probability), and the evidence it looked at. It is a starting point for your own check, not a verified cause.

Every claim in the result is checked against the evidence it cites before it is shown, and a claim that fails the check is withheld with the reason. Trace references are checked against your organization’s stored traces, so those links point to traces you can open.

This screen is the command center: a queue of every investigation, and a detail pane for the one you’ve selected.

What you see

The page has a summary strip above a two-pane layout: a state-aware queue on the left, a detail preview on the right.

Summary strip

Five clickable tiles — All, Active, High confidence, Needs review, Failed — each showing a count.

Clicking a tile filters the queue below to that segment. Morse decides each investigation’s bucket once, and uses it for both the row and the tile count, so the tile counts and the rows in the queue never disagree.

Investigation queue

Each row shows the agent name, an alert-type badge, a status or confidence badge, a one-line hypothesis, who investigated it (a specific model name, or “Morse” as a fallback), evidence count, recommended-action count, cost, and how long ago it ran.

A run that hasn’t landed a high-confidence hypothesis reads “Couldn’t form a confident hypothesis — needs review,” in italics, rather than showing a shaky guess as if it were settled.

Detail panel

Selecting a row opens its hypothesis, evidence grouped by kind (Traces, Metrics, Logs, Changes, Alerts, Quality), a numbered list of recommended actions, and a run-facts grid — status, model, cost against its cap, and duration.

An action rail lets you jump to the fired alert, the referenced trace(s), Ask Morse (with a pre-filled prompt about this investigation), the Reliability configuration for service-target early-warning alerts, or Quality when eval evidence is present.

On narrower screens the detail panel opens in a bottom sheet instead of a side pane.

Scope

Each investigation is scoped to one agent and one environment, and says so on the card — for example “Read this agent’s runs in the alert’s environment only.” An investigation offered on a change reads that change’s agent in that change’s environment. When an alert names no agent, or an agent has no single environment, the scope line says it read wider. Evidence that can’t be narrowed carries a note, such as “Agent-wide: this source records no environment.”

Offered on a worsened change

On an agent’s Changes tab, a lane of a confirmed change that got worse offers Investigate this change, with what it will do: “Looks only at this agent’s runs in this environment. Costs up to $0.05. Sends run summaries and error messages to {model}.” Nothing runs until a person selects it. Then it reads Investigating…, and See the investigation opens it here.

Morse investigates only changes you track and only measures that got worse; it says so if you try otherwise. Each change lane has at most one live investigation. Starting investigations on changes automatically is an organization setting that is off by default, and capped at 3 per agent per day when on. The offer is hidden in the demo workspace.

Claim checks

Before a result is shown, Morse checks each claim against the evidence the investigation read: that what it cites exists and is in scope, that its numbers match the tool results, that an outcome claim is backed by an agreed measurement, that a causal claim is supported, and that no cited evidence contradicts it. The checks are rules, not another model.

A claim that fails is withheld, and the card says why — for example “1 claim withheld: numbers did not match tool results.” The reasons are:

• a cited item is missing or outside this run’s scope
• a named ID was not backed by evidence this run read
• numbers did not match tool results
• no agreed measurement for outcomes
• the agreed measurement does not count outcomes
• too few runs have a recorded outcome to judge this
• cited evidence contradicts the claim

A causal claim that isn’t established is kept but labelled Coincides with, not established. When no claim supports a cause, the hypothesis reads “No supported explanation yet.” followed by the reason. If a check fails to run, nothing is shown — “Not checked.” — and Re-check tries again. Confidence is never high unless every claim passed.

Outcome claims

A claim about business outcomes — a resolution rate, a reopen rate, task success — counts only when the agent has an agreed success definition in its environment that counts the success rate, and outcomes cover at least the share of runs it asks for over the last 30 days. Otherwise the claim is withheld with one of the outcome reasons above. An investigation that isn’t scoped to one agent can’t make outcome claims.

Cost and confidence

Each investigation runs against a per-run dollar cost cap — $0.05 by default, about a nickel, unless your organization or a specific alert overrides it.

A run that hits its cap stops rather than overspending, and still saves whatever partial result it had — it doesn’t fail silently. A run still pending or running after 30 minutes is marked failed: “The investigation did not finish.”

How to use it

• On an agent’s Changes tab, select Investigate this change on a lane that got worse.
• Click a summary tile to filter the queue to that state.
• Click a row to load its hypothesis, evidence, and recommended actions in the detail pane.
• From the detail pane, jump to the alert, the trace(s) referenced as evidence, Ask Morse, Reliability, or Quality.
• Arriving from a fired alert with ?alert_id= in the URL preselects that alert’s investigation in the detail pane automatically.

Before you have data

Until someone starts one, or an alert fires with the Investigator on, the queue is honest about being empty:

• No investigations yet: “No investigations yet. Morse offers one when a change you track makes a measure worse: open the change and choose “Investigate this change”. You decide whether it runs.” It links to Open an agent’s History → and Reliability alerts →, beside a short How Investigations work explainer.
• A filtered segment with no matches: “No investigations match this filter.”

If the request to fetch investigations fails outright, the queue shows a “Couldn’t load investigations” state with a Retry button.

Related

• Alerts — the fired alert that triggers each investigation; its detail view shows the investigation status and links back here.
• Traces — the failed traces an investigation samples as evidence; a run opened from here shows Back to Investigations.
• Agent detail — where investigations are offered on worsened changes.
• Ask Morse — where “Ask Morse” sends its pre-filled prompt.