incident-investigation

Name: incident-investigation
Availability: InStock
Author: Tsuga

Investigate incident root causes using monitor-anchored telemetry, code, and change evidence.

2|Updated May 28, 2026

Search Tags:#root cause analysis #telemetry #incident investigation #evidence synthesis #change correlation #monitor alerts #codebase grep

Ready to run

npx skills add https://github.com/tsuga-dev/agent-plugins --skill incident-investigation-tsuga-dev

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: incident-investigation
Source: https://github.com/tsuga-dev/agent-plugins/tree/main/plugins/tsuga/skills/incident-investigation
Command: npx skills add https://github.com/tsuga-dev/agent-plugins --skill incident-investigation-tsuga-dev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you rapidly investigate live incidents and determine the most likely root cause using time-bounded, evidence-driven probes across telemetry, code, and change history.

Core Features & Use Cases

Parallel evidence collection: Coordinates a telemetry sweep, change correlation, codebase signal pinning, and hypothesis falsification in one workflow.
Monitor-anchored investigations: Starts from the emitting monitor query when available to ensure the investigation follows the exact signal that fired.
Time-safe causal reasoning: Enforces strict “declared_at” boundaries to prevent hindsight contamination and requires evidence validation before publishing.
Operator-ready verdicts: Produces a verdict with cited evidence and an explicit latest cited timestamp, or returns insufficient evidence when probes don’t converge.

Quick Start

Use the incident-investigation skill to investigate what is broken in the incident window and produce an operator-ready verdict with cited telemetry and time-bounded change evidence.

Frequently Asked Questions about incident-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform root cause analysis when a monitor alert fires?▼

Root cause analysis starts from the emitting monitor query and conducts a time-bounded investigation that synthesizes telemetry findings, emitting-code pins, and pre-declared change correlation. It applies strict evidence validation before producing an operator-ready verdict with cited sources.

What is the best way to investigate recurring system degradation using telemetry?▼

Investigating recurring degradation uses time-bounded, evidence-driven probes across telemetry, code, and change history to synthesize findings. It enforces strict declared_at gating to prevent hindsight contamination and requires evidence validation before publishing an operator-ready verdict.

Can I correlate codebase changes with telemetry symptoms during an active incident?▼

Yes, you can correlate codebase changes with telemetry symptoms through parallel evidence collection. The investigation coordinates a telemetry sweep, change correlation, codebase signal pinning, and hypothesis falsification in one workflow to determine the most likely root cause.

How do I find the emitting code location when investigating a monitoring alert?▼

Finding the emitting code location involves codebase signal pinning, which identifies the exact code locations responsible for the telemetry symptoms. The investigation anchors to the emitting monitor query and uses codebase grep to pinpoint the source.

Why does my incident investigation produce an insufficient evidence verdict?▼

An insufficient evidence verdict occurs when parallel evidence collection probes do not converge on a single root cause. The investigation requires evidence validation with explicit sources and coordinated branch outputs for telemetry facts, code locations, and change mechanisms before publishing.

Does incident investigation work for post-incident RCA as well as active incidents?▼

Yes, incident investigation applies to active incidents, post-incident RCA, and recurring degradation triage. It uses the same monitor-anchored, time-bounded approach with strict declared_at boundaries to ensure evidence-driven probes prevent hindsight contamination across all scenarios.