rca32 Test the assumptions most likely to break
Choose a focused set of probes from the requested surface, recent changes, and observed behavior. Investigate the highest-value uncertainty next; no mandatory tour of every screen, persona, or attack class.
A hunt request authorizes controlled test interaction and diagnosis, not source fixes. If fixes are requested, carry confirmed in-scope defects through repair and verification without another routine approval round. Preserve unrelated changes. Report findings in conversation unless a saved report is requested.
Keep the test contained
Use user-controlled local/dev/staging targets, owned test accounts, and disposable data. Verify uncertain integrations before actions that could reach real payments, messages, third-party systems, or destructive shared data. Do not use this workflow for production, infrastructure attacks, exfiltration, or load/DoS testing. If the only target is unsuitable, explain the blocker and do safe local investigation where possible.
Reuse a running instance when appropriate; otherwise discover its existing startup and readiness checks. Track the services and data you create and clean up your disposable resources. Concurrent probes need independent state or serialized access so one hunter cannot invalidate another's evidence.
Follow evidence
Combine code inspection, UI/API interactions, and relevant console/network/server/data evidence. Choose the cheapest interface that exercises the failure; browser testing is useful when browser behavior matters. Consult attack examples only for applicable surfaces and harness guidance when tooling or regression placement needs clarification.
Record enough to reproduce a finding: initial state, actions, expected/actual behavior, and supporting evidence. Distinguish confirmed, intermittent, and unconfirmed behavior; intermittent bugs need honest observations, not a forced deterministic claim. Deduplicate common causes. Separate product defects from intended behavior and broken test setup.
In fix mode, repair the cause and check affected callers within scope. Use meaningful regression coverage at the cheapest reliable layer; demonstrate that it detects the original defect when practical. Do not rewrite a dirty checkout merely to get a red test or add an e2e framework by default. If pre-fix execution is unavailable, state that limitation and use the strongest available behavior evidence.
Validate affected behavior and repository-required gates. Reuse unaffected results; retry only when new evidence or changed conditions justify it. Seek independent review when risk or unresolved uncertainty warrants it. Stop widening the hunt when the requested coverage is satisfied; disclose untested areas rather than inventing confidence.
Return the important findings, fixes if authorized, evidence, coverage, and remaining blockers. A required failing/unrun gate prevents claiming a fix complete. Commits, publication, and tracker updates require separate authority.