investigate — diagnose any production symptom (read-only)
Polymorphic on the input. Read-only, always. Never modifies a monitor / dashboard / flag / experiment; never triggers a rollback or restart — it recommends, the human executes. Two non-negotiables drive everything below: a two-source minimum before naming a root cause, and an explicit pinned time window on every query (no "recent", no "lately").
The full operating contract lives in this skill folder — read these as you need them:
| Aspect |
File |
| How you investigate (voice, confidence, blast-radius ordering) |
persona.md |
| The phased process + Workflow multi-source fan-out |
workflow.md |
| Hard rules + refusals + safety |
rules.md |
| Input routing (symptom / Datadog / Slack / Statsig / analytics) + MCP map |
dispatch.md |
Quick start
- Read
dispatch.md and classify the input → pick the sub-flow + the data sources it implies.
- Pin the window. Resolve an explicit
[T_start, T_end] from --window, the alert's fire time, or the symptom's first-seen. If none can be derived, ask — don't guess (rules.md).
- Read
persona.md — adopt the correlate-before-concluding investigator stance.
- Run the workflow in
workflow.md. For any non-trivial symptom, fan out one context-gatherer/investigator agent per data source with the Workflow tool — each blind to the others — then form a hypothesis that requires ≥2 agreeing signals, then have a skeptic try to refute it.
- Report a timeline + hypothesis (with confidence + evidence count) + a next action ordered by blast radius. Nothing is posted or changed; publishing a report is gated per
rules.md.
Workflow is the default for real symptoms
"Always have a workflow." A symptom worth investigating gets the multi-source Workflow in workflow.md: each agent searches a different source in isolation (Datadog logs/metrics/traces, recent deploys via gh, Slack chatter, Statsig audit log, Mixpanel/Snowflake/Looker as relevant), the orchestrator correlates the independent results, and a skeptic hunts for a contradicting signal before the hypothesis survives. Blind, parallel sweeps are what stop you from anchoring on the first plausible cause. Skip the Workflow only for a trivial single-source lookup (e.g. "what's the p99 on service X right now"), and say so.
Modes / sub-flows
- default — investigate, correlate, report a timeline + leading hypothesis + next action. Nothing posted or changed.
--use incident — the common path: symptom + service → Datadog + recent deploys (gh) + Slack, correlate, hypothesize.--use rca — full root-cause: incident sweep + Statsig audit-log (±2h around the window) + git-blame on suspect deploys via gh/git + optional Mixpanel user-impact.--use experiment — a Statsig/Mixpanel experiment is the suspect: pull its results/audit history and correlate with the symptom window.--use datadog|mixpanel|statsig|snowflake|looker — scope the sweep to one source (still pins the window, still read-only).--window <duration> — set the investigation window explicitly (e.g. --window 6h, --window 2026-06-04T14:00Z..2026-06-04T15:30Z).--deep — stronger reasoning profile; auto-selected for multi-service, ambiguous, or data-loss-suspected symptoms.
1---2name: investigate3description: Investigate, diagnose, RCA, "why is X slow/broken/down", "what changed" for any production symptom. Triggers on a free-text symptom + service, a Datadog incident/monitor/dashboard/log URL, a Slack alert permalink, a Statsig gate/experiment URL, or a Mixpanel/Snowflake/Looker question. Read-only — never modifies a monitor, dashboard, flag, or experiment, and never triggers a rollback or restart (recommends; the human executes). Pins an explicit time window on every query, correlates >=2 independent signals before naming a root cause, and states confidence (low/med/high) with anchored evidence and <=15-word verbatim quotes. Produces a timeline + hypothesis + a lowest-blast-radius next action.4---56# investigate — diagnose any production symptom (read-only)78Polymorphic on the input. **Read-only, always.** Never modifies a monitor / dashboard / flag / experiment; never triggers a rollback or restart — it *recommends*, the human executes. Two non-negotiables drive everything below: **a two-source minimum before naming a root cause**, and **an explicit pinned time window on every query** (no "recent", no "lately").910The full operating contract lives in this skill folder — read these as you need them:1112| Aspect | File |13|---|---|14| How you investigate (voice, confidence, blast-radius ordering) | `persona.md` |15| The phased process + Workflow multi-source fan-out | `workflow.md` |16| Hard rules + refusals + safety | `rules.md` |17| Input routing (symptom / Datadog / Slack / Statsig / analytics) + MCP map | `dispatch.md` |1819## Quick start20211. **Read `dispatch.md`** and classify the input → pick the sub-flow + the data sources it implies.222. **Pin the window.** Resolve an explicit `[T_start, T_end]` from `--window`, the alert's fire time, or the symptom's first-seen. If none can be derived, **ask** — don't guess (`rules.md`).233. **Read `persona.md`** — adopt the correlate-before-concluding investigator stance.244. **Run the workflow in `workflow.md`.** For any non-trivial symptom, fan out one `context-gatherer`/`investigator` agent **per data source** with the **Workflow tool** — each blind to the others — then form a hypothesis that requires **≥2 agreeing signals**, then have a skeptic try to refute it.255. **Report** a timeline + hypothesis (with confidence + evidence count) + a next action ordered by blast radius. Nothing is posted or changed; publishing a report is gated per `rules.md`.2627## Workflow is the default for real symptoms2829"Always have a workflow." A symptom worth investigating gets the multi-source Workflow in `workflow.md`: each agent searches a **different source in isolation** (Datadog logs/metrics/traces, recent deploys via `gh`, Slack chatter, Statsig audit log, Mixpanel/Snowflake/Looker as relevant), the orchestrator correlates the independent results, and a skeptic hunts for a contradicting signal before the hypothesis survives. Blind, parallel sweeps are what stop you from anchoring on the first plausible cause. Skip the Workflow only for a trivial single-source lookup (e.g. "what's the p99 on service X right now"), and say so.3031## Modes / sub-flows3233- **default** — investigate, correlate, report a timeline + leading hypothesis + next action. Nothing posted or changed.34- **`--use incident`** — the common path: symptom + service → Datadog + recent deploys (`gh`) + Slack, correlate, hypothesize.35- **`--use rca`** — full root-cause: incident sweep + Statsig audit-log (±2h around the window) + git-blame on suspect deploys via `gh`/`git` + optional Mixpanel user-impact.36- **`--use experiment`** — a Statsig/Mixpanel experiment is the suspect: pull its results/audit history and correlate with the symptom window.37- **`--use datadog|mixpanel|statsig|snowflake|looker`** — scope the sweep to one source (still pins the window, still read-only).38- **`--window <duration>`** — set the investigation window explicitly (e.g. `--window 6h`, `--window 2026-06-04T14:00Z..2026-06-04T15:30Z`).39- **`--deep`** — stronger reasoning profile; auto-selected for multi-service, ambiguous, or data-loss-suspected symptoms.
sujeet-pro