logging

Structured logging for investigation workflows uses JSONL files to record every event with a single UUID correlation ID, ensuring end-to-end traceability across all phases. This ties together phase transitions, tool executions, and gate decisions for easy diagnosis.

Tracing errors and performance metrics across investigation phases requires logging detailed error objects with stack traces and per-phase performance stats. JSONL entries capture this data automatically, allowing you to monitor reliability and speed throughout the workflow.

Querying JSONL logs to filter by case ID or specific tool executions is fully supported using built-in jq and grep examples. You can easily search structured JSON logs to isolate specific operations, correlation IDs, or discrepancy tracking events.

Context-aware logging during investigation phase transitions is maintained by continuously updating an inv_context.json file. This file integrates with the JSONL logs to capture entry points, sub-skill invocations, and gate checks, preserving context across the entire case.

Structured JSONL logs are needed for case investigations because they provide consistent, searchable records with timestamps and correlation IDs that standard text logs lack. This structure makes it significantly easier to trace actions, correlate data, and diagnose issues quickly.