case_open
Open a structured investigation case for a VMware incident by defining the event, scope, and timeframe. Returns a case ID, state, and ceiling grade to guide subsequent root-cause analysis.
Instructions
[WRITE] Open an investigation case — step 01, define the event.
WHEN: at the start of an incident you expect to reason about rather than glance at. For a one-off lookup use incident_timeline alone.
RETURNS: {case_id, path, state, grade, ceiling, ceiling_reasons, next}.
Read ceiling now — it is the best grade this install can reach at all.
GOTCHAS: writes only under $OPS_HOME, never to a VMware system, and never over an existing case.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| objects | No | Entities in scope, names or MoIDs ("vm-web01", "host-12"). Omit for a case not yet pinned to specific objects. | |
| summary | Yes | What is wrong, one line. case_plan reads it to infer the symptom category, so name the symptom in the estate's own words ("datastore latency on cluster-a"), not a diagnosis. | |
| window_end | No | Believed end, ISO-8601. Omit while still in progress. | |
| window_start | No | When the incident is believed to have started, ISO-8601. Omit if unknown — evidence gets fetched against it, so an invented window is worse than none. | |
| determined_by | Yes | HOW the scope was decided — "user report", "vCenter alarm 42". Required: a scope from a phone call and one from an alarm id support different conclusions, and nobody remembers which it was later. | |
| product_versions | No | Versions keyed by product — {"esxi": "8.0.3"} — plus "driver.<name>" / "firmware.<name>" entries. Knowledge-base entries are version-checked against this: one constraining a product absent here can support a hypothesis but never make the case Confirmed, since an unanswerable constraint is not a pass. |