Vestigivo RCA

Incident Intelligence & Root Cause Analysis for Visual Studio Code
Every incident leaves evidence.

A structured workspace for incident investigations — not a black-box root-cause oracle.

_{Actual Visual Studio Code screenshot · Vestigivo RCA 0.1.1 candidate · fully synthetic demonstration data}

Vestigivo RCA brings together logs, distributed traces, exact-identifier correlations and investigator notes in a single Control Center inside the editor. It preserves the separation between what was observed, what was correlated, what is still a hypothesis and what an explicitly controlled check can establish.

Why Vestigivo?

Incidents often involve several services, timestamps with differing precision, incomplete spans and separate sources. The risk is not just missing a signal: it is mistaking temporal proximity or a plausible story for proof.

Vestigivo turns selected evidence into a traceable, bounded investigation. It records where each observation came from and explicitly marks missing or ambiguous information. It never performs automatic remediation, uploads local logs or claims that correlation proves causation.

Current capabilities (0.1.2)

Control Center

Use the Vestigivo RCA icon in the Activity Bar or run Vestigivo RCA: Open Control Center. The main interface opens in an editor tab, not as a narrow sidebar.

Overview · Timeline · Evidence · Trace Tree · Correlations · Git Context · Report · Case Studio · Settings

To try a local investigation, choose Import evidence, select up to five supported files and inspect the resulting timeline and source fingerprints. In Case Studio, record a falsifiable hypothesis and — if appropriate — a manual verification plan. Save or export only when you explicitly choose to.

Explore the investigation workspace

All four screenshots below were captured from the actual Vestigivo RCA webview running inside the Visual Studio Code Extension Development Host on Linux, not redrawn or visually simulated. The incident is a clearly labeled synthetic fixture, parsed through the same evidence pipeline as local files. No real customer logs, tokens or incident data were used.

01 — Timeline: search, filter and inspect

Use exact trace/request identifiers, UTC date ranges, service and severity filters. Records retain source provenance and missing timestamps are not invented.

02 — Trace Tree: follow observed relationships

Explore span ancestry and inspect what is known, missing or ambiguous. Shared trace identifiers do not establish causation.

03 — Case Studio: build an evidence-backed investigation

Create and manage hypotheses, add notes, bookmark observations and document manual verification plans. A proposed explanation does not become a verified finding merely because it is recorded.

_{Capture provenance: media/screenshots/ · genuine Linux VS Code Electron/Xvfb screenshots, 1440 × 900, generated by the reproducible visual QA harness. The synthetic JSONL fixture is at test/fixtures/visual-demo.jsonl. See the technical checklist.}

Evidence and confidence

A verification plan with status PLANNED is not a test execution. Baseline/current comparisons distinguish introduced and pre-existing observations, never automatically prove a regression was caused by a particular change.

Privacy and trust model

• Local-first: no automatic file scanning, uploads, telemetry or AI calls by Vestigivo.
• Opt-in access: local imports use VS Code file pickers; Git inspection requires workspace trust and authorization; Sentry/Grafana require separate connection and an explicit read approval.
• Secret handling: provider credentials remain in VS Code SecretStorage. Reports and stored cases use best-effort redaction; no guarantee that every secret or personal datum is detected.
• Storage: cases are ephemeral until explicitly saved. Saved cases are not encrypted by Vestigivo; OS/VS Code protections apply.
• No remediation: never executes a captured command, changes a repository or deploys infrastructure to resolve an incident.

See Threat Model, Architecture and Acceptance Evidence.

Supported inputs and known limitations

JSON-based logs and OTLP JSON are supported. OTLP/gRPC Protobuf, a local OTLP collector, streaming imports, automated verification execution and broad causal inference are not implemented. Timestamp ambiguity remains explicit. Source limits default to 8 MiB per file and 10,000 observations per case.

Core tests, packaging and genuine Extension Host smoke now pass on Linux, Windows and macOS. WSL, SSH, Dev Containers, in-depth graphical accessibility audits and live cloud-provider checks remain release gates; do not infer certification from a passing unit test.

Development

Prerequisites: Node.js 22, npm and Visual Studio Code 1.96+.

npm ci --ignore-scripts --no-fund
npm run check              # TypeScript, core tests and coverage gates
npm run brand:verify
npm run benchmark          # Synthetic 1K / 10K / 100K budget exercise
npm run package:vsix       # vestigivo-<version>.vsix

For a genuine Extension Development Host on a graphical environment, build first and run npm run test:host. On Linux CI, xvfb-run -a npm run test:vsix-host tests the installed VSIX bytes in an isolated profile.

Release policy: 0.1.0 was bootstrapped manually and 0.1.1 was published via Trusted Publishing. 0.1.2 is the next candidate, adding a GitHub Release alongside Marketplace and Open VSX. Pull requests execute validation; only an approved, version-bumping merge into main may initiate automated publishing. The repository visibility is controlled separately by the owner; publishing does not change it. See GitHub Releases, Release Readiness, Release Setup, Master Specification and Technical Checklist.

Language

English is used for the marketplace README and the main technical API names. Documentación en español.

License and authorship

Distributed under the MIT License. The repository is public; the software and contributions are covered by the terms in the license file.

Designed and developed by Alejandro Daniel Di Stefano
© 2026 ArmoTuSitio · Open source under the MIT License