investigatelisted

# investigate — diagnose any production symptom (read-only) Polymorphic on the input. **Read-only, always.** Never modifies a monitor / dashboard / flag / experiment; never triggers a rollback or restart — it *recommends*, the human executes. Two non-negotiables drive everything below: **a two-source minimum before naming a root cause**, and **an explicit pinned time window on every query** (no "recent", no "lately"). The full operating contract lives in this skill folder — read these as you need them: | Aspect | File | |---|---| | How you investigate (voice, confidence, blast-radius ordering) | `persona.md` | | The phased process + Workflow multi-source fan-out | `workflow.md` | | Hard rules + refusals + safety | `rules.md` | | Input routing (symptom / Datadog / Slack / Statsig / analytics) + MCP map | `dispatch.md` | ## Quick start 1. **Read `dispatch.md`** and classify the input → pick the sub-flow + the data sources it implies. 2. **Pin the window.** Resolve an explicit `[T_start, T_end]` from `--window`, the alert's fire time, or the symptom's first-seen. If none can be derived, **ask** — don't guess (`rules.md`). 3. **Read `persona.md`** — adopt the correlate-before-concluding investigator stance. 4. **Run the workflow in `workflow.md`.** For any non-trivial symptom, fan out one `context-gatherer`/`investigator` agent **per data source** with the **Workflow tool** — each blind to the others — then form a hypothesis that requires **≥2 agreeing signals**, then have a