case_submit_evidence
Submit raw tool results as evidence to preserve findings, receive an immediate grade, and keep the case timeline accurate.
Instructions
[WRITE] Record one retrieved fact — steps 02/03 of the evidence loop.
WHEN: after every read-tool call you intend to reason from.
RETURNS: {case_id, evidence_id, payload_events, payload_note, grade, reasons} — the resulting grade, so you need no second call to see whether this changed anything, and what the payload was read as, so a summary submitted in place of a result is visible here rather than as a zero from case_timeline later.
GOTCHAS: a fetch that failed or came back empty goes to case_record_gap, not here.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | The exact parameters the tool was called with, so it can be re-run. Omit only if there genuinely were none. | |
| case_id | Yes | The case this fact belongs to (from case_open/case_list). Required. | |
| payload | No | The read tool's RAW result, not a summary. For its events to reach case_timeline it must be a list of event dicts, or carry them under 'items', 'events' or 'rows'. What was found comes back as payload_events/payload_note. | |
| summary | Yes | What this item shows, one line. | |
| falsifies | No | Hypothesis ids (H1, H2, …) this observation RULES OUT — the only route to Excluded; "we looked and found nothing" is a gap, not an exclusion. Ids must already exist via case_hypotheses; an unregistered id is refused and nothing is written. | |
| fetched_at | No | When the fetch happened, ISO-8601. Omit to stamp now — wrong for an item transcribed from earlier. | |
| window_end | No | End of the period the data covers, ISO-8601. | |
| source_tool | Yes | The tool within that skill, e.g. "get_events". Required, non-blank — "monitor said so" is not reproducible. | |
| time_source | No | Whose clock stamped it — "vcenter", "host" or "client". Recorded so a reader can judge whether two sources' timestamps compare; nothing in this release corrects for it. Null when unknown, never a guess. | |
| clock_skew_s | No | Known offset of that clock from UTC, in seconds. Recorded, likewise not applied. Null when unknown. | |
| source_skill | Yes | The skill that produced it, as the family spells it — "vmware-monitor", "vmware-aria", "vmware-log-insight". Required, non-blank. Two items from the SAME skill count as ONE source when corroboration is counted, so this string decides whether the case can reach Probable. Two reserved values name the knowledge layer instead: "knowledge-kb" and "knowledge-sr", the only sources that can be decisive. | |
| window_start | No | Start of the period the DATA COVERS, ISO-8601 — not when it was fetched. get_events(hours=24) run at 10:00 and at | |
| knowledge_entry_id | No | Which mounted knowledge entry this item IS. REQUIRED when source_skill is knowledge-kb or knowledge-sr — without it the entry's applies_to cannot be checked, so it counts as ordinary support and can never make the case Confirmed. case_knowledge lists what is mounted. |