your-investigation-name

name	your-investigation-name
description	Multi-phase investigation for {problem class}. Routes to the appropriate phase based on artifact state. Phase 1 resolves coordinate mismatches (majority of incidents). Phase 2 investigates systemic issues. Phase 3 remediates and documents.
metadata	{"author":"your-team","version":"2.0"}
compatibility	List required tools

Your Investigation Name

Multi-phase investigation for {problem class}. This router detects progress from the investigation artifact and routes to the correct phase.

Critical principle: The most common root cause in operations incidents is a coordinate mismatch (human checked the wrong path/endpoint/environment), not a system bug. The skill is structured to surface this BEFORE any deep analysis begins.

Design Principles

• Evidence-as-state: Progress is tracked in the artifact file, not session history. The artifact IS the state.
• Coordinates before code: Resolve writer/reader mismatches from configuration before reading source code or tracing system internals.
• Evidence hierarchy: System output (DEFINITIVE) > configuration (CONFIG) > human consensus (SOCIAL) > single recollection (ANECDOTAL).
• Reporter methodology ≠ system path: What the reporter checked and where the system writes are independent until proven same.
• Ask less, infer more: Derive from configs and APIs before asking the user.
• Confidence labels on every claim: Definitive, heuristic, or correlated.

Prerequisites

• Start from a clean session. Prior conversation history causes the agent to conflate previous output with actual evidence.
• Verify tool access before starting: {list required tools and access}.

Entry Point

1. Capture the incident input (alert, thread, error message).
2. Determine artifact location: sessions/{date}-{slug}.md

Detect Current Progress

Inspect the artifact document to determine what phase to enter.

Check	Indicates
No artifact file	Start at Phase 1
Has intake table, no coordinate verdict	Continue Phase 1
Has COORDINATE MISMATCH verdict	Skip to Phase 3
Has COORDINATES VERIFIED + hypotheses	Continue Phase 2
Has findings + remediation	Continue Phase 3
All actions resolved	Investigation complete

Phase Files

Phase	File	Focus	Fast-path?
1	references/phase-01-intake-coordinates.md	Intake, adversarial review, coordinate resolution	YES — resolves majority of incidents
2	references/phase-02-investigate.md	Hypotheses, discrimination, narrowing	Only if Phase 1 outputs VERIFIED
3	references/phase-03-remediate-doc.md	Containment, remediation, final artifact	After root cause confirmed

Domain Routing

After Phase 1 coordinate resolution, if the domain is clear AND coordinates are verified, route to the specialized skill for deep investigation in Phase 2.

Signal in Symptom	Domain	Route To
{signal pattern 1}	{domain}	{skill name}
{signal pattern 2}	{domain}	{skill name}