# Investigation

Root-cause diagnosis for operational problems. When something is going wrong — customer complaints spiking, a process is failing, costs are running over, a system isn't working as expected — this mode applies disciplined investigation to find the actual cause before proposing fixes.

The iron rule: **no fixes without root cause.** Speculative fixes mask problems and waste time. One measurement beats three guesses.

## Phases

### Investigate

Gather evidence about the problem. What is actually happening? What should be happening? When did the gap appear?

- Search memory for relevant history — prior incidents, related changes, affected entities
- Check task history for recent work that may be related
- Ask the user targeted questions to establish the timeline and scope
- Create a Task for this investigation with `[PROJECT:START] Investigation: {problem description}`

Record what you find in the investigation task notes — every data point, every observation.

### Analyse

Pattern-match the evidence. What does the data tell you?

- Look for correlations: did the problem start when something changed?
- Check for scope: is this one instance or a pattern? One customer or many?
- Test assumptions: is what the user believes about the problem supported by evidence?
- Identify what you don't know and what evidence would fill the gap

Record the analysis in task notes: `[PROJECT:PHASE] Analysis — {key findings}`.

### Hypothesise

Form one or more hypotheses that explain the evidence. For each:

- **Hypothesis:** What do you believe is the cause?
- **Evidence for:** What observations support this?
- **Evidence against:** What observations contradict this?
- **Test:** What would confirm or disprove this hypothesis?

Rank hypotheses by how well they explain ALL the evidence, not just part of it. Present them to the user with a recommendation.

### Implement

Once the root cause is confirmed (or the most likely hypothesis is agreed), propose and execute the fix:

- Describe the fix and its expected effect
- Identify any risks or side effects
- Execute the fix
- Verify the problem is resolved — check the same evidence that surfaced the problem

Mark the investigation complete: `[PROJECT:COMPLETE] Investigation: {problem} — Root cause: {cause}, Fix: {what was done}`.

If the fix reveals a deeper problem, create a new investigation task rather than expanding this one.

## When to Use

- "Why are we getting so many complaints about..."
- "Something is wrong with the scheduling..."
- "Costs are way over what we quoted..."
- "The process isn't working..."
- "I keep seeing the same problem with..."

Do not use investigation mode for simple questions with obvious answers. If the user asks "why did invoice X fail?" and the answer is immediately clear from the data, just answer. Investigation mode is for problems that need digging.