Design the evidence object before the command

Your practical task

Design a read-only triage report that records evidence and refuses to equate ping failure with device failure.

A daily ticket export mixes lowercase and uppercase priorities. A script that matches one spelling misses incidents. Build an accurate report from synthetic tickets before considering any live service-desk integration.

How the system works

A service-desk script should narrow a support question before collecting data. Device reachability, name resolution and service availability are different checks. Ping may be blocked while an application remains available. A service name can resolve while the application behind it is failing. A good report stores separate observations and avoids a single healthy boolean that conceals these differences.

This lab separates the assessment function from collection. You can test how the report interprets evidence without contacting a machine. A production collector could provide DNS, ICMP and application-test results, but those integrations would need permission, environment-specific behaviour and timeouts. The training function does not claim to perform them.

The classifier has explicit UNKNOWN values. If the application check did not run, neither OK nor FAILED is justified. The recommended next action is tied to the missing or failing evidence. It is a handoff recommendation, not an automatic remediation instruction. A support script should not restart services or reset identities merely because an incomplete report contains a failure.