Severity & confidence
How Ghost-hunter ranks hypotheses.
Ghost-hunter ranks hypotheses on two axes: severity (how much spend the hypothesis explains) and confidence (how strongly the evidence supports it).
Severity
| Level | Meaning |
|---|---|
| Critical | Explains ≥ 50% of the unexpected spend. |
| High | Explains 20–50%. |
| Medium | Explains 5–20%. |
| Low | Explains < 5% but is anomalous. |
Severity is computed from the billing CSV before any LLM call. The LLM does not pick severity.
Confidence
Confidence bars come from Opus and reflect how much corroborating evidence exists. A hypothesis starts at low confidence and rises as proposed commands return supporting output.
Hypothesis 1: BigQuery on-demand scan blew up [████████░░] 0.82
Hypothesis 2: Egress from us-central1 to EU [████░░░░░░] 0.41
Hypothesis 3: Idle Cloud SQL replica [██░░░░░░░░] 0.19
Ghost-hunter stops the loop when one hypothesis crosses 0.85 confidence or when no hypothesis has improved in three consecutive rounds.
Why this matters
The dual axis stops Ghost-hunter from chasing a high-confidence-but-low-severity rabbit hole, and stops it from anchoring on a high-severity-but-unsupported guess. The final report leads with the highest-severity hypothesis above the confidence threshold.