spotlight

Use when an investigation step may need an external integration such as browser acquisition, Maigret account discovery, Junkipedia narrative tracking, OSINT Navigator tool discovery, Noosphere C2PA signing, or Unpaywall access lookup.

Turn investigation findings into explicit, user-approved monitoring recommendations. Spotlight recommends; Mycroft owns any Scoutpost action.

OSINT investigation orchestrator — guides verified investigations from lead to findings to knowledge ingestion. Triggers on "investigate", "investigation", "OSINT", "look into", "dig into".

OSINT investigation toolkit — local SQL index of 12,500 tools (`osint-tools find`, offline), methodology guides, and optional OSINT Navigator (subscription tier). Works offline with any LLM.

Portable claim-to-evidence grounding for knowledge work, fact-checking, and Spotlight investigations. Use when extracting claims or findings, assigning confidence, diagnosing weak support, or deciding whether material is a lead, partially grounded claim, verified finding, disputed claim, or false claim.

Portable safe command construction for any agent skill or recipe. Use before a shell call containing user, model, scraped, configuration, filesystem, or generated values.

Stage and commit approved investigation findings through the Knowledge Workspace Port into the spotlight namespace.

Generate a self-contained HTML review artifact at the end of an approved investigation cycle; accept structured feedback; re-trigger the investigator to process it. No server required.

Investigation methodology for journalists — step-by-step techniques, platform OPSEC, and case studies from Bellingcat training materials.

Build a Spotlight provenance manifest and optionally hand it to Noosphere C2PA signing before the final review/report artifact is delivered.

Phase 5 hybrid synthesis — the model authors localized report framing and priority in report-draft.json; deterministic code validates finding references and renders the final Markdown, HTML, and evidence ledger.

Financial investigation methodology for journalists — corporate ownership, offshore structures, budgets, assets, and public blockchain tracing.

Passive technical methods for indicators, infrastructure history, local files, email headers, public GitHub, and verified export.

Archive evidence before it disappears — first-party snapshot (MHTML + screenshot, content-addressed) by default, plus third-party archives, with chain of custody for editorial accountability and legal defensibility

Work through the legal access hierarchy for paywalled or restricted sources before marking them inaccessible and downgrading confidence

Account authenticity assessment, coordination detection, and narrative tracking for social media investigations. Use when analyzing account networks, detecting bot activity or coordinated campaigns, tracking how claims spread across platforms, or building evidence trails from social content.

Convert repeated dev-browser acquisition successes into durable Spotlight acquisition guidance. Use after a non-trivial browser acquisition works repeatedly and should become a reusable source/domain path without storing secrets, cookies, or fragile session details.