Online Root Cause Analysis via Self-Gating Dual-Branch Causal Mechanism Tracking

Reliable microservice operation hinges on three telemetry-monitoring tasks: anomaly detection, root cause analysis (RCA), and drift adaptation. All three concern the causal mechanisms generating the stream and must run online, on data already containing the faults to flag. Existing methods sidestep this setting by 1) consuming an anomaly timestamp, 2) assuming a clean training period, or 3) trusting an upstream detector, so faults silently pollute the learned reference. We show this pollution is invisible to detection yet fatal to localization: the reference absorbs exactly the contaminated fraction of each shift, shrinking the localization margin while the detection contrast stays positive. We therefore propose GDRC, a self-gating dual-branch causal mechanism tracker. Each window flows through two branches over a shared causal graph. The invariant branch maintains the reference of normal mechanisms; the variant branch refits the window as a sparse mechanism shift. A self-gating sampler compares the two by a BIC-penalized likelihood ratio, yielding per-node gains and a window responsibility. This responsibility gates the reference update, requiring no labels, no clean period, and no upstream detector. One framework serves all three tasks: detection, localization, and drift are read off the gains, so no timestamp is needed and no module absorbs another's errors. Experiments on controlled streams and two real benchmarks show that achieves competitive root-cause accuracy. Run end to end on a stream, it raises its own alarm and ranks there nearly as well as at the true fault onset. The same gain absorbs real traffic-regime changes while catching the faults that follow. Code and results are in the supplementary material.