Hypothesis-Driven Investigation

When to activate

• A bug, crash, regression, or flaky behavior resists two or more direct fixes.
• A CTF, exploit, or reversing challenge has many possible paths and no obvious next step.
• An incident, outage, or unexpected production behavior has unclear scope or cause.
• Research, fuzzing, or scanner output points in multiple directions and must be triaged.
• The symptom is far from the likely cause: heap corruption, async timing, protocol state, ABI mismatch, cache coherence, cryptographic oracle, side channel, supply chain.
• The agent notices itself looping, repeating searches, or escalating tools without new evidence.

Do not activate for trivial fixes, single-line typos, or tasks where the user already gave a step-by-step procedure. Prefer the smallest competent workflow.

Core rules