What is Tessary's root cause analysis?

RCA is the third and last layer in Tessary’s analysis pipeline: a strong model, running in a microVM, investigates a confirmed case and returns grounded hypotheses for what changed. It only starts once the layer before it, triage, has confirmed a case is real.

A firewall separates the two model-driven layers: RCA receives the finding’s id and the case’s own trace evidence, never triage’s ruling on it. That keeps “nothing happened here” available as a genuine, independent RCA conclusion instead of an echo of what triage already decided, since it’s the only check on the layer before it.

RCA’s output is a root-cause report, and how much it can name depends on whether a repository is connected. Not every case ends in a named cause; when no hypothesis clears the bar, that absence is the reported outcome.