Saved work

Reckon keeps work local and structured so it survives the conversation. It does not run its own model or decide a root cause: the agent reads the saved evidence, tests explanations and records findings with the commands below. Every command works in the current org and environment (reckon preflight shows them).

Sessions for any taskCopy Anchor Link

reckon task --question "Weekly search review" --area gtm
reckon run gsc --session <id> --label "top queries 28d" -- top queries --site sc-domain:example.com --last 28d -o json
reckon note <id> --kind finding --text "..." --evidence <evidence-id>
reckon note <id> --kind hypothesis --text "..." --next-check "..."
reckon report <id>          # writes the briefing
reckon resume <id> --json   # everything saved, for a later conversation
reckon close <id> --outcome done
reckon history              # this org's sessions in this environment
reckon history --all-envs

--area takes dev, product, gtm, sales, ops or your own word, and --from/--to add an optional time window. reckon run --session saves the output as evidence with its command, connection, org, environment, time and hashes. A session refuses evidence from another org or environment.

Note kinds are finding, hypothesis, rejected and question. A finding or a rejected idea must cite successful evidence from the same session. That checks the reference, not the truth of the claim. close takes done, diagnosed (needs a finding) or inconclusive.

Incident investigationsCopy Anchor Link

Investigations add a mapped service, a time window and typed collection. Map services in knowledge/<env>/services.json in the org folder, starting from the checkout's examples/services.json. Replace its synthetic values and keep only the sources you use.

reckon services validate
reckon services show checkout
reckon capabilities

reckon debug --service checkout \
  --question 'Why did checkout latency increase?' \
  --from 2026-10-14T13:00:00Z --to 2026-10-14T13:30:00Z
reckon collect <id>

Starting a session is local; add --collect to read immediately. investigate, monitor and analyze start the same kind of session and record the mode. --playbook latency|errors|workload|changes chooses the guidance.

Mapped sources and their fields:

Each source needs a connection for the session's environment. On a shared backend such as CubeAPM, put the environment's label in the mapped queries. Databases, caches and queues are not part of typed collection: reach them with reckon run, which asks you first.

Follow a lead with one typed operation, or any read through reckon run:

reckon collect <id> --operation jenkins.build.get --params '{"job":"deploy/checkout","number":42}'
reckon run cubeapm --session <id> -- traces search --service checkout --env PROD --status error --last 1h -o json

Collection compares metrics with the preceding window of equal length. It runs at most 24 operations, each with a 15 second deadline (--timeout, at most 120) and a 1 MiB output cap (--max-bytes, at most 8 MiB), and caps metrics at 1,000 steps. Missing access, failures and truncation are saved as gaps; exit status 2 means collection was partial. A retry reuses successful evidence, and --refresh reads again.

Promote to an RCACopy Anchor Link

reckon promote <id> --slug checkout-latency

Promotion writes a preliminary snapshot to incidents/<date>-<slug>/ in the org folder with the evidence, briefing, RCA.md, alert.txt and learnings.md. It never overwrites an existing incident. Finish RCA.md with the RCA template. reckon history --all-envs also searches these RCAs, marked with an unverified environment. To share one as a PDF, see Exporting RCAs.

Try it offlineCopy Anchor Link

reckon demo

The demo creates a throwaway org under ~/.reckon/demos/ and runs synthetic CubeAPM, Grafana and Jenkins executables through real connections. It captures evidence, records a finding and an unresolved hypothesis, and prints a report path. It never uses your credentials or contacts a tool.

Storage and limitsCopy Anchor Link

Sessions live in ~/.reckon/orgs/<org>/workspace/sessions/<id>/. Known credential values and common bearer and URL credentials are redacted from saved output, but logs can still hold customer data: review before sharing. Evidence files are hashed, and Reckon refuses to reuse, cite or promote an artifact that changed. A nearby deploy alone is not evidence that it caused an incident.

The full reference, including operation parameters, is docs/INVESTIGATIONS.md in the repository.