A small vocabulary for causal systems.
IngaDB keeps the model deliberately compact: structure says how failure propagates, evidence supplies observations, and computed views turn both into traceable answers.
The causal model
One bounded causal model
Every topology, evidence record, view, revision, and delta belongs to a graph.
An observable failure
A leaf node with an identifier, label, component, and failure mode. Evidence attaches here.
How causes combine
AND and OR gates combine events or other gates into higher-level outcomes.
The complete structure
Events and gates together, written incrementally or replaced atomically.
Evidence and quantification
Evidence records capture incidents that occurred: component, failure mode, symptom, cause, fix, time, severity, confidence, and record kind. When linked to an event, observations feed empirical-Bayes probability estimation instead of leaving the model dependent on unqualified point estimates.
It pools sparse observations toward a shared prior, so two incidents are not treated with the same certainty as two hundred.
The analysis view
A computation returns four complementary views of risk:
| Output | What it answers |
|---|---|
| Minimal cut sets | Which smallest combinations of events can produce an outcome? |
| Quantities | What is the probability of each event and gate? |
| Importance | Which event contributes most, and which intervention moves risk most? |
| Uncertainty band | What P5–P50–P95 range follows from uncertainty in event rates? |
Traversal order and sampling are fixed, so identical inputs reproduce identical outputs.
Freshness and provenance
Every causal-input mutation increments the graph revision and records a delta in the same transaction. A computed view is stamped with its input revision. It is returned as fresh only while that stamp matches the current revision.
Analysis is stored at revision 41.
An event probability is updated.
Stale result plus the exact delta is returned.
Mechanism compilation
A workspace can store typed facts about failure modes, propagation, component composition, and redundancy. The compile endpoint derives the fault tree implied by those facts for a selected hazard. Compilation is read-only; the response includes branch cuts and the facts that justify each generated gate.
Tenancy
The organization is the tenancy unit. Data access is organization-scoped, and every mutating route passes through permission checks. Graphs remain isolated even when multiple teams share one IngaDB instance.