Evidence

What Horus collects during an investigation: typed, summarized, source-linked evidence from runtime systems, source intelligence, and git.

Evidence is the raw material of a Horus investigation. Instead of a narrative guess, Horus gathers concrete, typed evidence from your systems and links each piece to the code it implicates. Reports are built from evidence, and every claim traces back to it.

What counts as evidence

During horus investigate, Horus asks every configured source for evidence related to the hint. Each piece is tagged by source so you can see where it came from:

Tag	Source	Example
logs	Elasticsearch / Axiom / Sentry	Grouped error signatures with counts, trace IDs, and (Sentry) a top in-app frame seed
metrics	Grafana	Latency spikes, error-rate and throughput changes
state	MongoDB / PostgreSQL	Collection/table counts, staleness, status anomalies
state	Shopify Admin	Orders, inventory, fulfillment and other admin/business data (from the Admin GraphQL queries you supply)
queue	BullMQ	Queue depths, failed and delayed jobs
state	Redis	Cache key counts and prefixes (never values)
code	Source intelligence	Symbols, callers, and structure for implicated files
history	Local repository	Recent commits, ownership, and change history

Summarized, not raw

Evidence is minimized by design: connectors return counts, signatures, and statuses — not full documents, rows, or Redis key values. This keeps reports readable and limits what sensitive data is ever handled. See Security.

Linked to code

Where possible, a piece of evidence carries a code seed — a file, symbol, or line range — so an error or anomaly points directly at the implicated code. Source intelligence then expands that seed into callers and structure.

How evidence becomes a report

Horus combines runtime evidence with source-intelligence and git evidence, then ranks likely causes across the full set — no single source overrides another. The report surfaces only evidence that is relevant and non-empty.

Investigations are deterministic: the same inputs produce the same evidence and report. Re-render a saved report any time with horus replay <id>.

Evidence in Horus Cloud

When a repo is linked, evidence syncs with its investigation to Horus Cloud, where the team can browse it per investigation. Each item shows its source, its subject (service and environment), and a provenance strip — the engine query that produced it and when it was collected — and links to the implicated file and line range in your repository when one is known. A per-investigation Provenance graph lays out how that evidence supports each finding and cause. The same summarization applies to what syncs.