Explanatory Case Memo¶
Document — instantiates Abductive Explanation Selection
Records the observation, candidate explanations, comparison rationale, confidence, and next probes for audit or handoff.
The Explanatory Case Memo freezes an in-progress inference at a point in time so it can survive being handed to someone else. Into fixed slots it captures the observation, the candidate explanations considered, why the current best beat its nearest rival, an explicit confidence label, the open probes, and — the slot most often missing elsewhere — who owns the explanation now. Its defining move is durability with attribution: it is not a comparison engine and not a live ledger of change, but a signed, dated snapshot that lets a successor continue the investigation without re-deriving the reasoning or losing track of how tentative it is.
Example¶
A security-operations analyst ending a night shift saw anomalous outbound traffic from a finance server at 02:00. Rather than leave a one-line ticket, she writes the memo. Observation: ~4 GB egress to an external IP during a window with no scheduled user activity — recorded as the trace, not "we were breached." Candidates: command-and-control beaconing from a compromised host; a misconfigured backup job; a sanctioned data export; DNS tunnelling. Best-so-far: backup misconfiguration — the volume and cadence match the nightly backup window and the destination is a known vendor range. Nearest rival not excluded: C2 beaconing, because the destination's reputation is unverified. Status: working, medium confidence, not cleared. Open probes: verify IP reputation; pull the backup service logs. Owner: handed to the day-shift lead by name. The incoming analyst picks up exactly where she left off.
How it works¶
- Separate observation from interpretation in the first slot; the trace is recorded verbatim, the explanation elsewhere.
- Name the nearest rival explicitly alongside the current best, with a one-line reason the best is preferred and the rival not yet retired.
- Attach a defeasibility label — working, contested, high-confidence-provisional — so a reader knows how much weight it can carry.
- List the open probes and assign a named owner, then timestamp and sign. Fixed slots ensure nothing tacit is dropped in the handoff.
Tuning parameters¶
- Slot rigidity — a fixed template versus free narrative. Rigid slots prevent silent omissions but can feel bureaucratic on trivial cases.
- Confidence vocabulary — controlled labels versus prose hedging. A shared label set travels better across readers; prose carries nuance a label flattens.
- Detail depth — terse pointer versus full reasoning. More detail aids audit; less speeds turnaround at the risk of losing the rationale.
- Owner granularity — a named person versus a team queue. Naming a person fixes accountability; a queue survives staffing churn.
When it helps, and when it misleads¶
Its strength is that it preserves reasoning, not just a conclusion, across people and time — the audit trail that lets a later reviewer see what was believed, why, and how sure anyone was.
Its failure mode is diagnostic momentum: a label written into a handoff hardens as it is relayed, each reader trusting the last and no one re-examining the evidence, so a tentative "probably a backup job" quietly becomes fact by the third shift.[n1] The classic misuse is writing the memo after the outcome is known, polishing it with hindsight to look decisive. The guarding discipline is to keep the nearest rival and the confidence label prominent so the next reader is invited to reopen, and to date and attribute every entry so momentum can be traced back to its source.
How it implements the components¶
surprising_observation_record— the first slot captures the trace, held distinct from interpretation.best_so_far_explanation— the memo's headline claim, recorded as provisional.rival_comparison_record— the nearest-rival line with the reason for preference.defeasibility_status_label— the explicit confidence/status tag the memo carries forward.explanation_owner— the named accountable holder to whom the case is handed.
It does not implement candidate generation or explanatory_fit_criteria (Anomaly-to-Hypothesis Workshop and Inference-to-Best-Explanation Matrix); it names open probes but does not design them (Disconfirming Probe Plan).
Related¶
- Instantiates: Abductive Explanation Selection — the archetype's handoff-and-audit artifact.
- Consumes: Inference-to-Best-Explanation Matrix — the comparison whose result the memo narrates.
- Sibling mechanisms: Inference-to-Best-Explanation Matrix · Differential Diagnosis Workup · Anomaly-to-Hypothesis Workshop · Abduction Log · Disconfirming Probe Plan · Forensic Scenario Reconstruction · Model-Debugging Hypothesis Loop
Editorial Notes¶
Form Classification¶
Form family: Record, Log & Register
Rationale: Explanatory Case Memo operates as a durable record, ledger, register, or trace whose value depends on preserving actual state or history because it records the observation, candidate explanations, comparison rationale, confidence, and next probes for audit or handoff.
Independent corroboration: The frozen evidence defines Explanatory Case Memo as 'Records the observation, candidate explanations, comparison rationale, confidence, and next probes for audit or handoff', so its operative form is Record, Log & Register.
Nearest alternative: Representation, Specification & Plan — The signed memo preserves an actual case's observation, rival explanation, confidence, probes, and provenance rather than serving only as a reusable template.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Philosophy
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Universal
Rationale: Recording candidate explanations, comparative reasons, confidence, and discriminating probes operationalizes philosophical abduction.
Related originating lineages:
- Medicine & Healthcare — Clinical differential-diagnosis notes independently developed structured observation, candidate-explanation, confidence, and follow-up records.
- Security Studies & Intelligence Analysis — Analytic tradecraft materially contributes auditable hypotheses, confidence, and collection gaps.
Review resolution: Both reviewers agree that philosophy is primary. I retain security_intelligence, medicine_healthcare only as formative origin lineages; cross_disciplinary_synthesis is appropriate because the final form materially combines the agreed primary with the retained formative lineages. Reach is universal because the structure is portable across essentially any domain with the stated problem, an applicability judgment kept separate from provenance. Encyclopedia synthesis is true because the exact generalized artifact is an encyclopedia-authored combination or refinement. No unresolved historical ambiguity remains after reconciling the secondary fields.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; medium confidence.
Notes¶
The memo is a snapshot for transfer; the Abduction Log is the trajectory over time. A case with one handoff wants a memo; a case reopened repeatedly as evidence trickles in wants a log. They are complementary — a memo is often the closing entry that seals a log for handoff to another team.
[n1] Diagnostic momentum — the tendency for a label, once affixed and passed along, to gather perceived certainty at each relay while the underlying evidence is never re-examined. Studied first in clinical handoffs, it is the specific hazard a written explanatory record both risks and, if the rival and confidence are kept visible, can counter. ↩