IncidentLab

IncidentLab investigates why a Docker app on Linux has stopped working, explains the cause with evidence, and verifies the fix. Given a complaint like "uploads have stopped working", Muse Spark chooses read-only checks (containers, logs, disk and inode usage, directory permissions, Docker events) and writes a report in which every finding cites the evidence behind it. Code checks each citation against the raw evidence. After a person approves, IncidentLab runs one predefined repair and verifies recovery the way a user would: it uploads a random file, downloads it and compares SHA-256 hashes. It targets the failures that mislead people: a health check that passes while uploads fail, or a database that reports healthy while the app can't reach it. I evaluated it on 15 lab cases, 3 runs each, with the cases and expected answers committed before any run. IncidentLab answered 44 of 45 runs correctly, with no false alarms. A rule-based baseline using the same checks got 42 of 45: it called a broken system healthy in all three runs of one case, which IncidentLab diagnosed every time. 99% of citations matched the evidence, and all 30 repairs that ran were verified.