Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
rysweet avatar

Investigation Workflow

  • 240 installs
  • 70 repo stars
  • Updated July 26, 2026
  • rysweet/amplihack

investigation-workflow is a Claude agent skill that runs a 6-phase investigation recipe for hypothesis testing, evidence collection, and root-cause documentation when developers need to understand production bugs, incide

About

investigation-workflow is a Claude Code skill from rysweet/amplihack (version 2.0.0) that enforces a systematic six-phase investigation recipe for understanding existing systems, codebases, and architectures. Unlike implementation workflows, it optimizes for exploration: scope definition, exploration strategy, parallel deep dives, verification, synthesis, and knowledge capture. The skill normally runs as a sub-recipe via dev-orchestrator and smart-orchestrator, but supports standalone invocation through the amplihack recipe runner with a 4000-token budget. Developers reach for investigation-workflow when production bugs, CI failures, or architecture questions need structured hypothesis testing instead of ad hoc file reading. Phase 3 deploys parallel architect, patterns, and security agents; Phase 4 validates understanding through practical verification; Phase 6 stores discoveries via amplihack.memory.discoveries and updates PATTERNS.md. Direct invocation requires running amplifier-bundle/recipes/investigation-workflow.yaml—manual phase following is explicitly discouraged because the recipe runner enforces ordering and quality gates.

  • Structured root-cause investigation steps
  • Hypothesis-driven evidence gathering
  • Reproduction and bisection guidance
  • Incident-ready documentation outputs
  • Pairs with agent-driven debugging

Investigation Workflow by the numbers

  • 240 all-time installs (skills.sh)
  • +1 installs in the week ending Jul 26, 2026 (Skillselion tracking)
  • Ranked #148 of 597 Debugging skills by installs in the Skillselion catalog
  • Data as of Aug 2, 2026 (Skillselion catalog sync)
npx skills add https://github.com/rysweet/amplihack --skill investigation-workflow

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs240
repo stars70
Last updatedJuly 26, 2026
Repositoryrysweet/amplihack

How do you investigate unfamiliar production system failures?

Follow a repeatable investigation workflow when production bugs, incident reports, or ambiguous failures need structured hypothesis testing, evidence collection, and root-cause documentation.

Who is it for?

Developers debugging production incidents, recurring CI failures, or complex architectures who need a recipe-enforced six-phase investigation with parallel agent deep dives.

Skip if: Greenfield feature implementation, one-line bug fixes, or tasks better handled by the default-workflow recipe without exploration overhead.

When should I use this skill?

A developer asks to investigate how a system works, explain architecture, analyze failures, or understand why CI or production behavior is broken.

What you get

Investigation report, verified hypotheses, consolidated findings, and durable knowledge entries in discoveries memory and PATTERNS.md.

  • investigation report
  • verified hypothesis notes
  • PATTERNS.md updates

By the numbers

  • Version 2.0.0 with a 6-phase investigation workflow
  • Allocates a 4000-token budget per invocation
  • Executable recipe defined in amplifier-bundle/recipes/investigation-workflow.yaml

Files

SKILL.mdMarkdownGitHub ↗

Investigation Workflow Skill

Relationship to Dev Orchestrator

Normal execution path: This workflow is invoked as a sub-recipe by the dev-orchestrator skill via smart-orchestrator. You do NOT normally need to activate this skill directly.

User request → dev-orchestrator → smart-orchestrator recipe
    → investigation-workflow recipe (this skill's recipe)

Direct invocation is supported as a compatibility path when the dev-orchestrator is unavailable or when explicitly requested. In that case, use the recipe runner (see Execution Instructions below).

Workflow Graph

flowchart TD
    INIT[Initialize Tracking] --> P1

    subgraph P1["Phase 1: Scope Definition"]
        SCOPE[scope-definition<br/>prompt-writer agent] --> AMB{Has ambiguities?}
        AMB -->|yes| CLARIFY[clarify-ambiguities<br/>ambiguity agent]
        AMB -->|no| P1_OUT[Scope defined]
        CLARIFY --> P1_OUT
    end

    subgraph P2["Phase 2: Exploration Strategy"]
        STRAT[exploration-strategy<br/>architect agent] --> PAST[check-past-investigations<br/>patterns agent]
        PAST --> HIST{Historical context needed?}
        HIST -->|yes| ARCH[historical-research<br/>knowledge-archaeologist]
        HIST -->|no| P2_OUT[Strategy ready]
        ARCH --> P2_OUT
    end

    subgraph P3["Phase 3: Parallel Deep Dives"]
        DD1[deep-dive-primary<br/>architect agent]
        DD2[deep-dive-secondary<br/>patterns agent]
        DD3[deep-dive-tertiary<br/>architect agent]
        DD4{Specialist needed?}
        DD4 -->|yes| DDS[deep-dive-specialist<br/>security agent]
        DD1 & DD2 & DD3 --> CONSOL[consolidate-findings<br/>patterns agent]
        DDS --> CONSOL
    end

    subgraph P4["Phase 4: Verification"]
        HYP[formulate-hypotheses<br/>architect agent] --> EXEC[execute-verification<br/>architect agent]
        EXEC --> VAL[validate-verification<br/>reviewer agent]
    end

    subgraph P5["Phase 5: Synthesis"]
        PAT[identify-patterns<br/>patterns agent] --> SYN[synthesis<br/>architect agent]
        SYN --> VSYN[validate-synthesis<br/>reviewer agent]
    end

    subgraph P6["Phase 6: Knowledge Capture"]
        DISC[update-discoveries] --> PATN{New patterns?}
        PATN -->|yes| UPAT[update-patterns]
        PATN -->|no| RPT[create-investigation-report]
        UPAT --> RPT
    end

    P1 --> P2 --> P3 --> P4 --> P5 --> P6

    RPT --> TRANS[transition-guidance<br/>patterns agent]
    TRANS --> EFF[efficiency-report]
    EFF --> FINAL[final-output]

    TRANS --> TDEV{Transition to dev?}
    TDEV -->|yes| DW[Launch default-workflow<br/>recipe via recipe runner]
    TDEV -->|no| DONE[Investigation Complete]

Purpose

This skill provides a systematic 6-phase workflow for investigating and understanding existing systems, codebases, and architectures. Unlike development workflows optimized for implementation, this workflow is optimized for exploration, understanding, and knowledge capture.

It is normally executed as a sub-recipe by the dev-orchestrator via smart-orchestrator, but can also be invoked directly via the recipe runner.

Canonical Sources

  • Executable source (recipe): amplifier-bundle/recipes/investigation-workflow.yaml
  • Reference documentation: .claude/workflow/INVESTIGATION_WORKFLOW.md

The recipe YAML is the authoritative execution definition. The .md file serves as human-readable reference documentation for the workflow phases.

Execution Instructions

Normal path (via dev-orchestrator)

If you reached this skill via dev-orchestrator / smart-orchestrator, the recipe runner is already managing execution. Do not re-invoke the recipe runner. The orchestrator handles the full lifecycle including goal-seeking reflection loops.

Direct invocation (standalone)

If this skill is activated directly (not via dev-orchestrator), you MUST use the recipe runner — do NOT read the .md file and follow phases manually:

amplihack recipe run amplifier-bundle/recipes/investigation-workflow.yaml \
  -c task_description="TASK_DESCRIPTION_HERE" \
  -c repo_path="." \
  --verbose

Do NOT read INVESTIGATION_WORKFLOW.md and follow phases manually. The recipe runner enforces phase ordering, agent deployment, and quality gates that manual execution cannot replicate.

Preferred: Use dev-orchestrator instead

For most tasks, invoke Skill(skill="dev-orchestrator") or use /dev <task> rather than activating this skill directly. The dev-orchestrator adds goal-seeking reflection, workstream decomposition, and adaptive error recovery on top of this workflow.

When to Use This Skill

Investigation Tasks (use this workflow):

  • "Investigate how the authentication system works"
  • "Explain the neo4j memory integration"
  • "Understand why CI is failing consistently"
  • "Analyze the reflection system architecture"
  • "Research what hooks are triggered during session start"

Development Tasks (use default-workflow recipe instead):

  • "Implement OAuth support"
  • "Build a new API endpoint"
  • "Add feature X"
  • "Fix bug Y"

Core Philosophy

Exploration First: Define scope and strategy before diving into code Parallel Deep Dives: Deploy multiple agents simultaneously for efficient information gathering Verification Required: Test understanding through practical application Knowledge Capture: Document findings to prevent repeat investigations

The 6-Phase Investigation Workflow

Phase 1: Scope Definition

Purpose: Define investigation boundaries and success criteria before any exploration.

Tasks:

  • FIRST: Identify explicit user requirements - What specific questions must be answered?
  • Use prompt-writer agent to clarify investigation scope
  • Use ambiguity agent if questions are unclear
  • Define what counts as "understanding achieved"
  • List specific questions that must be answered
  • Set boundaries: What's in scope vs. out of scope
  • Estimate investigation depth needed (surface-level vs. deep dive)

Phase 2: Exploration Strategy

Purpose: Plan which agents to deploy and what to investigate, preventing inefficient random exploration.

Tasks:

  • Use architect agent to design exploration strategy
  • Use patterns agent to check for similar past investigations
  • Identify key areas to explore (code paths, configurations, documentation)
  • Select specialized agents for parallel deployment in Phase 3

Phase 3: Parallel Deep Dives

Purpose: Deploy multiple exploration agents simultaneously to gather information efficiently.

CRITICAL: This phase uses PARALLEL EXECUTION by default.

Phase 4: Verification & Testing

Purpose: Test and validate understanding through practical application.

Phase 5: Synthesis

Purpose: Compile findings into coherent explanation that answers original questions.

Phase 6: Knowledge Capture

Purpose: Create durable documentation so this investigation never needs to be repeated.

  • Store discoveries in memory using store_discovery() from amplihack.memory.discoveries
  • Update .claude/context/PATTERNS.md if reusable patterns found

Transitioning to Development Workflow

After investigation completes, if the task requires implementation, the dev-orchestrator handles the transition automatically via its goal-seeking reflection loop. If running standalone, transition by launching the default-workflow recipe:

amplihack recipe run amplifier-bundle/recipes/default-workflow.yaml \
  -c task_description="Implement findings from investigation..." \
  -c repo_path="."

Integration with Dev Orchestrator

The dev-orchestrator automatically detects investigation tasks using keywords and routes them to this workflow's recipe:

User: "/dev investigate how authentication works"

dev-orchestrator: Classified as Investigation → launching investigation-workflow recipe
→ Recipe runner executes 6-phase investigation workflow
→ Results feed into goal-seeking reflection loop

For hybrid tasks (investigate + implement), the dev-orchestrator decomposes into parallel workstreams: one running investigation-workflow, another running default-workflow.

Key Principles

  • Scope first, explore second - Define boundaries before diving in
  • Parallel exploration is key - Deploy multiple agents simultaneously in Phase 3
  • Verify understanding - Test your hypotheses in Phase 4
  • Capture knowledge - Always store discoveries in memory in Phase 6
  • This workflow optimizes for understanding, not implementation

Related Resources

  • Recipe (executable): amplifier-bundle/recipes/investigation-workflow.yaml
  • Reference docs: .claude/workflow/INVESTIGATION_WORKFLOW.md
  • Dev Orchestrator: .claude/skills/dev-orchestrator/
  • Default Workflow: .claude/skills/default-workflow/
  • Agent Catalog: .claude/agents/amplihack/ directory
  • Pattern Library: .claude/context/PATTERNS.md

Related skills

How it compares

Choose investigation-workflow for understanding and root-cause analysis; use default-workflow when the primary goal is implementing a feature or fix.

FAQ

How many phases does investigation-workflow include?

investigation-workflow includes six phases: scope definition, exploration strategy, parallel deep dives, verification and testing, synthesis, and knowledge capture. Version 2.0.0 defines these in amplifier-bundle/recipes/investigation-workflow.yaml, which the recipe runner enforc

Should investigation-workflow be invoked directly?

investigation-workflow is normally invoked by dev-orchestrator via smart-orchestrator as a sub-recipe. Direct standalone use is supported through amplihack recipe run on investigation-workflow.yaml, but most tasks should route through dev-orchestrator for goal-seeking reflection

What artifacts does investigation-workflow produce?

investigation-workflow produces an investigation report, verified hypotheses, consolidated findings, and durable knowledge stored via store_discovery() in amplihack.memory.discoveries. Reusable patterns are appended to .claude/context/PATTERNS.md so repeat investigations of the s

Debuggingtestingbackendintegrations

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.