Evidence

What Horus collects during an investigation: typed, summarized, source-linked evidence from runtime systems, source intelligence, and git.

Evidence is the raw material of a Horus investigation. Instead of a narrative guess, Horus gathers concrete, typed evidence from your systems and links each piece to the code it implicates. Reports are built from evidence, and every claim traces back to it.

What counts as evidence

During horus investigate, Horus asks every configured source for evidence related to the hint. Each piece is tagged by source so you can see where it came from:

Tag	Source	Example
logs	Elasticsearch / Axiom / Sentry / Azure Monitor / CloudWatch / Google Cloud Logging / Lens	Grouped error signatures with counts, trace IDs, and (Sentry) a top in-app frame seed
metrics	Grafana / Prometheus	Latency spikes, error-rate and throughput changes
state	MongoDB / PostgreSQL / Firestore / SQL Server	Collection/table counts, staleness, status anomalies
state	Shopify Admin	Orders, inventory, fulfillment and other admin/business data (from the Admin GraphQL queries you supply)
queue	BullMQ / Azure Service Bus / Kafka	Queue counts and status, or committed offsets and lag
state	Redis	Cache key counts and prefixes (never values)
code	Source intelligence	Symbols, callers, and structure for implicated files
history	Local repository	Recent commits, ownership, and change history

Summaries and evidence payloads

Database and queue adapters generally return counts, status distributions, dates, or offsets. Logs can retain messages and structured fields, and Shopify retains the data returned by your supplied query. Keep those queries narrow. Default JSON output is compact; --full includes raw evidence payloads. Cloud sync uploads the saved report rather than the compact view. See Security.

Linked to code

Where possible, a piece of evidence carries a code seed — a file, symbol, or line range — so an error or anomaly points directly at the implicated code. Source intelligence then expands that seed into callers and structure.

How evidence becomes a report

Horus combines runtime evidence with source-intelligence and git evidence, then ranks likely causes across the full set — no single source overrides another. The report surfaces only evidence that is relevant and non-empty.

Investigations are deterministic: the same inputs produce the same evidence and report. Re-render a saved report any time with horus replay <id>.

Evidence in Horus Cloud

When a repo is linked, evidence syncs with its investigation to Horus Cloud, where the team can browse it per investigation. Each item shows its source, its subject (service and environment), and a provenance strip — the engine query that produced it and when it was collected — and links to the implicated file and line range in your repository when one is known. A per-investigation Provenance graph lays out how that evidence supports each finding and cause. The synced snapshot contains the full saved report, including its evidence payloads.