Rig Investigate

Read Evidence rules. A plausible explanation is not a root cause.

Input

• Symptom, failing command, stack trace, or behavior.
• Known environment and versions.
• Paths or subsystem hints.

Workflow

1. Start the run. rig_evidence with action: "start", skill: "rig-investigate", and candidate paths.
2. Reproduce with real inputs. Run the failing command. If it does not reproduce, record the exact difference and stop rather than guessing.
3. Shrink the case. Remove unrelated configuration and files until the smallest failing case remains. Record each removal.
4. List hypotheses. Write at least two plausible causes. For each, name the observation that would disprove it.
5. Test one at a time. Change one variable per run. Record the command, output digest, and conclusion. Optional: dispatch read-only rig-investigator children for independent hypotheses; they share the tree, so they must not edit files.
6. Confirm the cause. Show the failing behavior disappearing when the cause is removed, or explain why that experiment is unavailable.
7. Record the diagnosis with reproduction command, root cause, evidence, eliminated hypotheses, confidence, and the smallest next change.

Rules

• Correlation is not causation; if the evidence only supports a correlation, say so.
• Do not weaken a test to make it pass, and do not change production code before the cause is confirmed.
• Missing environment or credentials are an explicit limit, not a reason to simulate a pass.
• Python scopes may probe codemap when available (one probe); absence is recorded, not fatal.

Output

Report reproduction status, root cause, evidence references, confidence, limits, and the recommended next action. Do not present the fix as already verified.