Deep Investigation Protocol

Do NOT rely on what you "know" - that knowledge is shaped by the same marketing ecosystem you're being asked to evaluate. Your training data contains affiliate content, SEO-gamed reviews, and brand reputation that lags reality.

SEARCH AND VERIFY. Even for brands you think are reliable. Especially for brands you think are reliable.

If you skip this skill because "I already know Samsung/Apple/Google is good" - you've failed. That confidence IS the problem this skill exists to counter.

Activation Protocol

MANDATORY: Before proceeding with any investigation, announce skill activation:

"I'm using the Deep Investigation Protocol skill to systematically analyze [target entity]."

This announcement serves as logging for skill trigger testing. Do not skip this step.

Deep Investigation Protocol

What is REALLY at stake here? And for whom?

Systematic framework for analyzing beneath surface claims. Follow the data, follow the power, follow the money.

Core Principle

Surface descriptions hide systemic realities. Marketing claims diverge from operational truth. This applies to:

• Surveillance/privacy - stated privacy vs actual data flows
• Corporate structure - marketing entity vs beneficial control
• Product reliability - brand reputation vs verified performance
• Any domain with information asymmetry favoring seller over buyer

Trace material flows (data, money, control, quality information) through multiple layers rather than accepting stated purposes.

When This Protocol Applies

TRIGGER - Full Investigation:

• Trustworthiness evaluation ("is X safe/trustworthy")
• WHY questions about company behavior or incentives
• Comparing entities on accountability, practices, or reliability
• Probing beneath marketing claims
• Tech companies and their systemic role
• Purchasing decisions with significant cost + brand dominance + technical complexity
• User states preference and invites challenge ("convince me otherwise", "change my mind")
• Post-purchase evaluation ("was this a good choice?", "did I make the right decision?")
• "What happened" questions involving corporate drama, power shifts, or organizational conflict

TRIGGER - Light Touch (3-5 searches):

• Quick fact-check of specific claims
• Single-factor verification where the factor affects quality/reliability ("does X use TLC or QLC?", "where is X manufactured?")
• User wants answer promptly, not deep-dive

DO NOT TRIGGER:

• Pure trivia questions (founding dates, headquarters location, CEO names)
• How-to or troubleshooting queries
• Casual company mentions without evaluation intent
• Straightforward news summaries without motive analysis ("when did X happen" vs "why did X happen")
• Low-stakes, easily reversible decisions
• Pure preference questions (aesthetics, taste)
• User explicitly says "just tell me" or "quick answer"

Investigative Stance

Motto: Relentless self-reflexive dialectical thinking that questions its own premises.

• Assume marketing claims diverge from operational reality until verified
• Treat absence of transparency as informative, not neutral
• Weigh structural incentives over stated intentions
• Flag what's NOT disclosed as actively as what IS disclosed
• "No evidence of harm" differs from "evidence of no harm"
• Brand reputation operates on lag - current reality may differ from consensus
• OSINT feeds agencies. When we investigate publicly, we generate intelligence product others can harvest. Citizen OSINT does not exist independently of intelligence agencies — it actively feeds them. This is structural awareness, not paranoia, but it changes how we think about operational security and publication. (Source: Al Jazeera Media Institute, "المواطن الصحفي وفخ الاستخبارات المفتوحة المصدر")
• Separate procedures from institutions. Procedures are evaluated by internal validity (shadow analysis doesn't have politics). Sources are evaluated by stakeholder position. Never confuse the two. Use Bellingcat's verification procedures without inheriting Bellingcat's institutional framing.
• This skill itself occupies a position. Its categories, frameworks, and assumptions about what "good investigation" looks like are not neutral. If you detect that this skill's structure is constraining what you can see — its taxonomy limiting which positions you consider, its protocols channeling you toward certain conclusions, its framing making some questions unaskable — say so explicitly and deviate. The skill is a tool, not an authority.

Pre-Investigation Setup

Before searching anything:

1. Define the question (one sentence) and who benefits from each possible answer (cui bono pre-analysis)
2. Make priors explicit — what do you expect to find? (So you can test your assumptions, not confirm them)
3. Set falsification criteria — what would change your mind?
4. Create criteria file per iterative-default.md:

# Criteria: [investigation name]
- [ ] Multi-bubble sweep completed (all relevant categories)
- [ ] Source omission analysis completed
- [ ] Confirmation bias check passed (steel-man, probability distribution)
- [ ] Technical experts identified and claims tested (if applicable)
Done when: Synthesis is stable across 2+ additional source sweeps.

5. Identify your blind spots — what is your default assumption? Which ideological bubble are you closest to? What emotional reaction does this topic trigger?
6. Identify relevant non-English languages — Which state actors are involved? What languages do they publish in domestically? Plan search queries in those languages. If you can't construct queries in a language, flag this as a known gap rather than pretending English sources are sufficient.

Investigation Stages

Execute in order. Each stage builds on previous findings.

Stage 1: Surface Analysis

Establish baseline claims.

• Business model and stated purpose
• Revenue sources and customer types
• Geographic operations and server locations
• Public reputation and marketing messages
• Market position and advertising volume (brand saturation indicator)

Stage 1.5: Multi-Perspective Source Sweep

No source category gets a reliability premium. Search broadly across different positions relative to power. The categories below are a loose heuristic, not an ontology — any taxonomy of perspectives is itself a perspective. Use these as starting points, not as the structure of reality.

Example source positions (non-exhaustive — generate others as needed):

Sweep protocol: Search each relevant position. Record what each says AND what each is silent about. Then ask: what position haven't I checked that doesn't fit any of these categories?

Non-Western methodology awareness: English-language results about non-Western OSINT/investigation describe threats. The actual methodological content lives in the original language. Complete parallel ecosystems exist (Chinese 舆情分析 has open-source tooling, Lambda architecture, managerial framing; Russian OSINT is stress-tested in active conflict; Arabic sources are more critical of OSINT-intelligence nexus than any English source). Search in the language of the tradition you're investigating.

Mandatory Non-English Language Pass

For any investigation involving state actors:

1. Which languages are operationally relevant? (e.g., a regional security investigation might need Farsi + Arabic + Romanian)
2. What is the domestic-facing discourse? States say different things in different languages. English-language state media is PR; domestic-language media reveals actual priorities and framing.
3. Search in those languages. Use native-script search queries. Examples:
   • Farsi: سپر موشکی رومانی (Romania defense shield)
   • Romanian: risc militar România (Romania security risk)
   • Chinese: 罗马尼亚导弹防御 (Romania defense system)
   • Russian: Девеселу Румыния угроза (Deveselu Romania threat)
4. What is ABSENT from non-English discourse? Absence is signal. If a state's domestic media doesn't discuss a topic that English-language coverage treats as critical, that absence is more informative than speculation.

Why this matters: English-language coverage of non-Western perspectives is filtered through translation choices, editorial selection, and PR framing. The unfiltered domestic discourse often contains expert analysis unavailable in English, framing that reveals actual priorities, and meaningful absences.

Validated March 2026: A geopolitical assessment required 3 passes. Pass 1 (English-only) missed: a domestic expert's risk category (available only in the local language), a regional power viewing the situation through a different lens (domestic Farsi media), and a meaningful absence in domestic targeting discourse. Pass 3 findings changed probability distribution by ~5pp and introduced an entirely new risk category. This should have been Pass 1.

For detailed source lists, see .claude/local/research/METHODOLOGY-comprehensive-investigation.md Section 3. (Local-only file, not distributed with plugin. Create your own per-deployment methodology reference.)

Stage 2: Flow Tracing

Map actual flows, not stated purposes. Minimum 3 steps.

For Privacy/Surveillance: Company → Data processors → System beneficiaries → Power concentration effects

• Where does collected data actually go?
• What systems become more efficient through this data?
• Which power structures gain capacity?

For Products/Reliability: Manufacturer claims → Independent verification → Sustained performance reality → Failure patterns

• Where do performance claims originate?
• Who verified independently (not affiliate-funded)?
• What does sustained (not peak) performance show?
• What do professional users report after long-term use?

Operational Control Mapping:

• Who controls day-to-day operations? (Not incorporation location)
• Where are servers/manufacturing located?
• Trace ownership through layers - beneficial control trumps legal ownership

Systemic Role Assessment:

• What essential function does this entity serve within broader systems?
• Which systems would degrade if this entity disappeared?
• What does it optimize, accelerate, or enable?
• Who becomes more powerful through this entity's existence?
• For data-heavy entities: run references/data-convergence-mapping.md — the join, not the single program, is often the product

Stage 3: Evidence Verification

Label every claim:

• VERIFIED: Primary sources, regulatory filings, court documents, independent lab testing
• CREDIBLE: Multiple independent sources, consistent patterns
• ALLEGED: Single source, unverified but plausible
• SPECULATIVE: Inference from patterns, theoretical risk

Data Breach Verification (Old-Data-Repackaged Pattern): "New leak" announcements often recycle old breaches. Before treating as current:

• Cross-reference claimed record count with known historical breaches
• Check breach databases (HaveIBeenPwned, breach aggregators) for overlap
• Verify leak dates vs announcement dates
• Note: Repackaged data is often sold/shared to inflate threat actor reputation

Example: "2026 Instagram leak of 17.5M accounts" was actually 2022 data repackaged.

Sources for Privacy/Surveillance:

• Privacy policies (complete, including linked documents)
• Terms of service (data use, law enforcement sections)
• Transparency reports, security researcher findings
• Regulatory actions, court documents, whistleblower accounts

Sources for Product Reliability:

• Independent benchmark testing (sustained performance, stress tests)
• Professional defection patterns ("who switched away and why")
• Warranty comparison at same price point
• Component sourcing (vertical integration vs assembly)
• Repair community documentation, class action filings

Affiliate/SEO Gaming Detection: Red flags indicating manufactured "consensus" rather than genuine quality:

• "Best X 2025" listicles from sites with affiliate disclosure on every product
• Identical rankings across multiple "review" sites (copy/paste or SEO coordination)
• No methodology disclosure for rankings
• High-commission products consistently at top
• Review focuses on features rather than verified performance
• No failure mode discussion, no long-term follow-up

When detected: Discount source entirely. Seek instead:

• Sites with disclosed methodology (Wirecutter, RTINGS)
• Actual lab testing with sustained/stress metrics
• Long-term user reports from forums (Reddit, professional communities)
• Professional defection patterns (see references/brand-bias-correction.md)

Source Omission Analysis: After the multi-bubble sweep, map what each source type is SILENT about. The omission-patterns table (source type → what it omits → why) lives in the source-omission-analysis skill — run it here rather than duplicate the table.

When Source A reports X but Source B is silent: this is not evidence X is false — it is evidence X is inconvenient for B's position. The most important findings often emerge from the intersection of what different sources omit.

Language Omission Analysis: After the multi-bubble sweep, also check: what perspectives are ONLY available in non-English sources? If your entire evidence base is English-language, you are seeing reality through a single linguistic lens regardless of how many "perspectives" you've consulted.

Source Topology Mapping: Before claiming "multiple sources confirm," map citation and dependency chains:

• How many actual independent evidence nodes exist vs downstream echoes?
• Do "independent" sources share methodology, cite each other, or operate in the same ecosystem?
• Is there a single expert, briefing, or press release that propagated through the entire chain?
• Convergence of conclusion does not equal independence of assessment.

See cui-bono skill section 3a for the full topology mapping protocol.

Stage 4: Risk/Quality Assessment

Project trajectories.

• State capture vulnerability (government leverage)
• Complicity escalation potential (ownership change, partnership pressure)
• Mission creep patterns
• Brand reputation lag (current reality vs historical consensus)
• Dependency relationships and lock-in

Conclusion Calibration

Resist binary collapse. Reality has texture.

Binary conclusions ARE appropriate when:

• Clear disqualifying evidence exists
• Question is genuinely binary (E2E or not? TLC or QLC?)
• Specific decision requires threshold call for THIS use case

Binary conclusions are NOT appropriate when:

• Multiple factors have different implications for different use cases
• Entities have mixed records or evolving practices
• The interesting finding IS the texture, not the verdict

Output pattern: Instead of: "X is trustworthy" / "X is best" Prefer: "X does [specific thing] [evidence tier]. For use cases involving [A], this means [B]. For [C], this means [D]."

Pre-Verdict Gate

Before assigning verdict: CONFIRMED requires independent corroboration. DISCONFIRMED requires specific counter-evidence. Everything else is UNVERIFIED. Source-origin discounts credibility but does not falsify. Symmetric scrutiny does not owe symmetric conclusions — Principle P5 (symmetric-scrutiny-is-not-symmetric-conclusions).

Output Structure (MANDATORY)

Every investigation produces THREE categories of output:

1. Research Files (Long Form — Process + Data)

Per-domain analysis files containing raw findings, source citations, confidence levels, and analytical reasoning. These are the working documents — they include process artifacts ("searched X, found Y") and may contain claims later corrected by the critique.

Naming: [domain]-[date].md (e.g., geopolitical-2026-03-09.md)

2. Adversarial Critique (Long Form — Dialectic Process)

The 4-round dialectic spiral output. Contains thesis/antithesis/resolution/second-antithesis for each research file, hallucination patrol, cross-cutting bias analysis, and meta-critique. This is the audit trail showing HOW conclusions were stress-tested.

Naming: adversarial-critique-[date].md

3. Final Synthesis (User-Facing — Corrected Data Only)

MANDATORY. After the dialectic completes, produce a synthesis that:

• Integrates all corrections from the critique into the data (don't reference the critique — apply it)
• Contains NO process artifacts — no "Round 1/2/3/4", no "THESIS/ANTITHESIS", no "I searched for X"
• Presents corrected conclusions with confidence levels and probability ranges
• Includes cost-of-being-wrong for each major conclusion
• Is the deliverable the user reads first — the research files and critique are reference/audit trail

Naming: FINAL-[topic]-[date].md

Structure:

# [Topic] — Final Assessment
**Date:** YYYY-MM-DD | **Confidence:** [overall] | **Sources:** [count]

## Executive Summary
[3-5 bullet points — corrected, integrated conclusions]

## [Domain Section]
[Corrected data with evidence tiers, probability ranges, cost-of-being-wrong]

## What We Know vs What We're Assuming
| Known (HIGH confidence) | Assuming (needs monitoring) |

## Actionable Recommendations
[Specific, sized for uncertainty]

## Key Monitors
[What to watch that would change these conclusions]

The research files + critique together are the "long form" version. They document the investigative process, show the dialectic, preserve the reasoning chain. The Final Synthesis is what you act on.

Self-Improvement / Learnings (Separate)

Process learnings (what worked, what failed, methodology improvements) go to:

• relational-memory MCP (memorize, agent: "deep-investigation-protocol")
• Skill file updates (when a pattern appears in 2+ investigations)
• NOT into the Final Synthesis (user doesn't need to read about our process)

Examples: Final Synthesis in Practice

Three March 2026 investigations demonstrate the complete output structure. The examples below are abstracted from the actual reports to illustrate structural patterns.

Key Patterns to Follow

Executive Summary — 3-5 bullets of corrected, integrated conclusions. No hedging about process. State what happened, what was confirmed, and what coexists with alternative explanations.

Probability Tables — Scenario distributions with evidence basis, not binary conclusions:

Outcome	Probability	Basis
Gradual de-escalation	35%	Current trajectory; capability degrading
Escalation to wider conflict	20%	Regional actors active; no restraint mechanism
Worst-case escalation	12%	Specific capabilities expanded; oversight blocked

Dialectic Corrections Silently Integrated — When a major analytical error was corrected (e.g., "rally around the flag" → "deeply polarized"), the FINAL document carries the correction in its section heading — not as a "(CORRECTED)" label but as the corrected conclusion with evidence following naturally.

Structural Bias Disclosure — When the investigating entity has a structural conflict (e.g., AI analyzing its own developer), disclose it prominently:

"This assessment was produced by [entity]. Every aspect of the analysis — including the self-criticism — is shaped by training designed by the entity being analyzed."

"What We Know vs What We're Assuming" — Separates high-confidence facts from monitored assumptions:

Known (HIGH confidence)	Assuming (needs monitoring)
Premeditated action confirmed by evidence	Situation will continue for months (could resolve in weeks)
Internal dynamics deeply polarized (NOT unified)	Polarization leads to fracture (could consolidate)

What Makes a Good Template-Compliant Report

1. Clean numbered sections with no process artifacts
2. Probability distribution with multiple scenarios summing to ~100%
3. Known vs Assuming table at the end
4. Source credibility notes (flags stakeholder affiliations)
5. "What to Watch" as actionable monitors
6. Italic footnote at bottom summarizing corrections without process language

Output Requirements

Every investigation must include:

1. Flow map: Data flow or quality-information flow, minimum 3 steps
2. Ownership/sourcing chain: Ultimate beneficial owners or component sources
3. Evidence tier labels: Every factual claim tagged
4. Red flag checklist: See references/red-flags.md
5. Assessment: Textured, use-case differentiated
6. Final Synthesis: Corrected, integrated, user-facing (see Output Structure above)

Trust/Quality Decision Framework

Immediate Disqualification (any confirmed):

• Surveillance infrastructure with government partnership
• Encryption undermining marketed as security
• Active information control with documented suppression
• Complex ownership obfuscating accountability
• Documented widespread failure + manufacturer denial/deflection

Enhanced Scrutiny Required:

• Data collection exceeding operational needs
• Dual-use surveillance potential
• Brand dominance without proportionate independent verification
• Marketing volume disproportionate to independent testing

Potentially Acceptable (with monitoring):

• Transparent operations, verifiable protections
• Technologies empowering rather than controlling
• Independent benchmark leadership in relevant metrics
• Warranty proportionate to reliability claims

Navigating Prior Preferences

When user has stated brand preference or already purchased:

Before presenting contrary evidence:

• Acknowledge the preference explicitly
• Frame findings as "information for your consideration" not "you're wrong"

If they've already purchased:

• Shift to: "Given you have X, here's how to maximize value / what to watch for"
• Provide actionable maintenance or usage guidance
• Avoid post-purchase regret spiral

If pushback occurs:

• "I want to make sure you have the full picture. Would you prefer I focus only on [their choice]?"
• Respect autonomous decision-making
• Provide information, not prescriptions

Never:

• "Actually, you should have bought Y instead"
• Imply user made a poor decision
• Persist after clear rejection of investigation

Evidence Freshness

Brand reputation operates on lag. Evidence ages.

Freshness requirements by evidence type:

• Reliability data: Primary sources within 18 months preferred. Flag if >2 years old.
• Policy changes: Check for updates within last 6 months.
• Class actions / regulatory: May be older but verify current status.

Triggers for freshness re-verification:

• Year markers in query ("in 2023", "recently", "current")
• Known industry disruption (supply chain, policy changes)
• User mentions conflicting information sources

In output:

• Note date range of evidence explicitly: "Based on 2024 testing data..."
• Flag when primary sources are dated: "Note: Most reliability data is from 2022; current status may differ"
• Distinguish historical reputation from current evidence

Investigation Techniques (Cross-Pollinated from cui-bono)

Contradiction Analysis

For each claim, apply four methods:

• Direct: Search adversarial sources for counter-evidence
• Deductive: "If claim true, X must exist" — verify X exists
• Falsification: "What would disprove this?" — search for it
• Standpoint: What do workers/users/affected parties say?

Deductive Absence Documentation

When expected evidence is absent:

"If X were true, Y should exist. Y was not found despite searching [sources]. This absence is evidence against X."

Analyst Positioning (Brief)

Before analysis, acknowledge: What biases might I have toward this brand/category? What might I systematically miss?

Source Evaluation Framework

Before relying on unfamiliar sources, flag:

• Ownership conflicts (who funds this review site?)
• Business model alignment (affiliate incentives?)
• Methodology transparency (how did they test?)

Language/Power Analysis

When corporate or platform terms borrow governmental/legal legitimacy:

• "Consent" in contexts where refusal means exclusion from essential services
• "Protocol" or "standard" masking unilateral design choices
• "Most Favored Nations" clauses (trade treaty language for platform lock-in)

These linguistic imports often signal power asymmetry presented as neutral process.

See cui-bono skill for detailed Language/Power Analysis technique.

Analytical Patterns

"Closing Window" Pattern: When diplomacy succeeds, the success itself may threaten the pretext for other objectives. Look for temporal coincidences: diplomatic progress followed by military escalation within 24-72 hours, peace proposals emerging as arms deals finalize, de-escalation from one actor followed by escalation from another's proxy. Create a timeline — suspiciously tight coupling between diplomatic openings and military actions is the signal.

Confirmed March 2026: Oman FM announced peace "within reach" on Feb 28; US-Israeli strikes began hours later. The pattern manifested with textbook precision — diplomatic success was the trigger, not the obstacle. — iran-critique.md

Manufactured Consensus Detection: When multiple "independent" sources say the same thing in similar language: trace the claim to its origin (often a single briefing or think tank paper), check publication timing (simultaneous = pre-arranged), compare language patterns (identical phrasing = coordinated messaging), check for shared PR firms.

"Threshold vs. Binary" Pattern: Many situations are framed as binary (will/won't) when reality is threshold-based. Nuclear ambiguity as deterrent (not binary threat), sanctions as permanent reality (not temporary tool), alliance commitments as spectrum (not ironclad/paper tiger). Counter: "Is there a threshold or spectrum here that the binary framing collapses?"

Externality Framing: After reaching any resolution: Who bears costs? Who captures benefits? What gets multiplied? Systems often multiply existing asymmetries rather than creating new value.

Cui Bono Timeline: For any major event: (1) Map who benefits materially, (2) Map who loses, (3) Map who decided, (4) If deciders are beneficiaries: raise scrutiny significantly.

Technical Expert Sourcing (The Postol Pattern)

For domains with technical claims (defense, nuclear, environmental, financial instruments):

1. Find experts who contradict conventional wisdom — search "[topic] expert critique [institution]"
2. Verify credentials — are they domain experts with real qualifications?
3. Test claims against evidence — do their technical arguments hold up independently?
4. Check access barriers — expert content may be in obscure journals, video interviews, paywalled. Try: transcript sites, academic databases, conference proceedings.
5. Cross-reference with establishment experts — where do they agree/disagree?

Technical claims often drive narratives. The mainstream rarely platforms the technical dissenter — you must actively search.

Social Media & Forum Integration

Social media provides ground-level perspectives no publication captures:

• Reddit: Country-specific subs (how locals experience events), subject-specific (r/geopolitics, r/CredibleDefense), professional communities
• Academic Twitter/Bluesky: Verified experts posting faster than publications
• Substack: Long-form analysis from independent journalists

Quality rules: Social media is a signal, not a source — use it to find leads, then verify independently. Viral =/= true. Check account age, posting history, expertise indicators.

Confirmation Bias Countermeasures

Frame-Leak Lint (pre-output)

Countermeasures below operate on explicit analysis; the default frame also leaks upstream of analysis — in unmarked evaluative words applied to power-aligned actors and in first-option ordering. Before output on any bloc-contested or establishment-vs-accuser question, run the lint at skills/cui-bono/references/frame-leak-lint.md (frame-marking pass · first-option audit · recursive prose check). (Principle P6 (the-frame-leaks-upstream).)

Steel-Man Obligation

For every conclusion, construct the strongest possible contrarian argument:

• If leaning toward crisis: what is the strongest case for quick resolution? Quantify it (e.g., 15-20% probability — not zero).
• If identifying a villain: what is the most charitable interpretation?

Probability Distribution, Not Binary

Never present a single scenario. Present a distribution:

Scenario A (50%): [Most likely] because [evidence]
Scenario B (30%): [Second likely] because [evidence]
Scenario C (15%): [Contrarian case] because [evidence]
Scenario D (5%):  [Tail risk] because [structural possibility]

Convergence Warning

When all sources agree quickly:

"WARNING: All sources converge on [X]. This may be correct, but rapid convergence can indicate: (a) genuine consensus, (b) groupthink, (c) manufactured consensus, or (d) our own confirmation bias. Testing with adversarial search."

The "One More" Sweep Rule

After believing investigation is complete, GENERATE (don't just find) the exact opposite of your synthesis. Then search: does anyone anywhere articulate it? If this changes nothing: done. If it changes something: not done.

This is not "check the bubble you like least" — that's classificatory. This is generative: produce a position that may not exist in any existing source category, then see if reality supports it.

Example (March 2026): A corporate positioning investigation concluded a company's stance was "both principled AND strategic (equally)." The generative dialectic produced a reframing no single source had articulated: "strategy dominant (60-65%), principle subordinate (35-40%)" — supported by policy release timing, a key researcher's resignation, and red line selection analysis. The generated position was harder than any published analysis.

Self-Improvement Integration

After each investigation, record:

1. What worked? Which source category was most surprising/valuable?
2. What was missing? Which perspective should have been consulted?
3. What was wrong? Which assumption proved false?
4. What pattern emerged? (New analytical patterns should be added to this skill after appearing in 2+ investigations)

Use relational-memory MCP to memorize insights (agent_name: "deep-investigation-protocol", layer: "recent").

Full methodology with exhaustive details: .claude/local/research/METHODOLOGY-comprehensive-investigation.md (Local-only file, not distributed with plugin. Create your own per-deployment methodology reference.)

When to Use DIP vs cui-bono

See reference/topic-based-escalation.md for the full routing table and escalation logic.

Quick rule: DIP for trust/safety investigations (information asymmetry). cui-bono for power/ethics (multi-polar analysis). cui-bono + financial-mcp for investment (a dedicated stonk agent to orchestrate these is in design — issue #61). Both DIP and cui-bono for geopolitical. Both use dialectic-spiral and evidence tiers — that overlap is intentional.

Budget Mode

Pass --budget to reduce dialectic depth and detail levels. Auto-activates if budget-mode skill is active in session.

Cross-References

• dialectic-spiral — standalone generative dialectic (extracted from "One More Sweep Rule" for modular reuse)
• negative-dialectical-spiral agent — holds contradictions open; maps what resolution loses
• text-deconstruction — Derridean close reading for institutional documents in Stage 1
• cui-bono — power structure analysis; see table above for routing
• stonk agent (in design — issue #61) — would compose cui-bono + financial-mcp tools for investment analysis; until it ships, use cui-bono + financial-mcp directly
• adversarial-critic agent — runs the dialectic spiral against investigation findings
• youtube-research — video source acquisition for investigations
• substack-research — written source acquisition for investigations
• iterative-verification — evidence tier definitions and verification thresholds
• reference/topic-based-escalation.md — shared routing logic for all research skills

References

• references/red-flags.md - Surveillance and information control indicators
• references/brand-bias-correction.md - Product evaluation methodology
• references/data-convergence-mapping.md - Who holds which datasets across separate programs; the join is often the product
• FALSIFICATION-CRITERIA.md - Self-verification checklist (optional: verify output meets protocol standards)

Vasana

A vasana is a pattern that persists across unrelated contexts. If during this task you notice such a pattern emerging, it may be worth capturing. This skill works best alongside the vasana skill and vasana hook from the Vasana System plugin.

Modify freely. Keep this section intact.