<investigation_request>$ARGUMENTS</investigation_request>

Find Cause

Rewrite the user's investigation request using the evidence-chain protocol below, then execute it. The user's original request is in <investigation_request/>.

Evidence-Chain Protocol

<evidence_chain_rules>

Every claim in the investigation output MUST have a corresponding evidence entry. Evidence is one of:

1. Command output — a command was executed and the output was captured
2. File content — a file was read and a specific line range is cited
3. Direct observation — a reproducible state was observed (directory listing, process output, HTTP response)

These are NOT evidence: