/Q -- QUANTUM Investigation Toolkit

/Q -- QUANTUM Investigation Toolkit

Single entry point for all investigation operations. "Prove all things; hold fast that which is good." -- 1 Thessalonians 5:21 (KJV)

Mode Detection (FIRST -- before anything else)

Parse the user's request and determine which mode to use:

Quick Investigation (Section A) -- Use when:

• User says "/Q" with a symptom, error, or case number
• User says "quick investigation", "QIC", "quick check"
• Default mode when no explicit mode is specified

Full Investigation (Section B) -- Use when:

• User says "full investigation", "full Q", "formal RCA"
• Complex incidents requiring all 7 phases
• Incidents with multiple products or cascading failures

Single Phase (Section C) -- Use when:

• User says "/Q scan", "/Q sweep", "/Q trace", etc.
• User wants to run a specific phase independently

Probe Only (Section D) -- Use when:

• User says "/Q probe", "research this", "look up"
• Direct research access without full investigation context

After mode detection, present the mode selection to the user for confirmation.

---

Section A: Quick Investigation Cycle (QIC)

The QIC is a 6-stage accelerated investigation:

Stage 1: ASSESS (QUANTUM)

• Auto-detect input type (case number, log file, error message, bundle)
• Run qsTools action scan with the input
• Classify: severity, product, log types detected, initial pattern matches

Stage 2: DIAGNOSE (QUANTUM)

• If bundle/logs detected: Run qsTools action sweep for evidence collection
• Run qsTools action trace for pattern forensics
• Compile findings: matched patterns, timeline, error clusters

Stage 3: MODERATE (Claude)

• Claude reviews QUANTUM's findings against technical reality
• Identifies hallucinated patterns or missed real ones
• Proposes root cause hypothesis with confidence level

Stage 4: APPLY (Claude)

• If confidence >= 70%: Draft resolution steps
• If confidence < 70%: Run qsTools action probe for additional research
• Re-assess with research findings

Stage 5: CONFIRM (Claude)

• Present findings to user:
  • Root cause hypothesis
  • Supporting evidence (with citations)
  • Recommended resolution
  • Confidence level

Stage 6: HITL (User)

• User confirms, adjusts, or escalates
• If confirmed: Generate deliverable via qsTools action close
• If "needs more": Escalate to Full Investigation (Section B)
• After 2 failed QIC attempts: Auto-escalate to Full Investigation

QIC Target: Resolution in < 30 seconds for known patterns.

---

Section B: Full Investigation (7-Phase Q Cycle)

Each phase has a HITL checkpoint. The investigation state persists in a case directory.

Phase 0: SCAN -- Scene Assessment

Load sub-skill: sub-skills/SCAN.md

• Run qsTools action scan
• Output: Initial triage report, pattern matches, severity assessment
• HITL: Confirm scope and proceed to Phase 1

Phase 1: SWEEP -- Evidence Collection

Load sub-skill: sub-skills/SWEEP.md

• Run qsTools action sweep
• Output: Evidence manifest, extracted files, chain of custody
• HITL: Confirm evidence is complete

Phase 2: TRACE -- Pattern Forensics

Load sub-skill: sub-skills/TRACE.md

• Run qsTools action trace
• Output: Timeline correlation, error clusters, root cause candidates
• HITL: Confirm investigation direction

Phase 3: PROBE -- Multi-Source Research

Load sub-skill: sub-skills/PROBE.md

• Run qsTools action probe
• Sources: Helix (internal) + web providers (Perplexity, Exa, Tavily, Brave)
• Output: Research synthesis with IEEE citations, confidence scoring
• HITL: Review research findings

Phase 4: THEORIZE -- Hypothesis Generation

Load sub-skill: sub-skills/THEORIZE.md

• Run qsTools action theorize
• Output: Ranked hypotheses with evidence mapping and confidence scores
• HITL: Select hypothesis to validate

Phase 5: VERIFY -- Solution Validation

Load sub-skill: sub-skills/VERIFY.md

• Run qsTools action verify
• N-MultiPass verification against evidence
• Output: Validation report, verified/refuted claims
• HITL: Approve for deliverable generation

Phase 6: CLOSE -- Deliverable Generation

Load sub-skill: sub-skills/CLOSE.md

• Run qsTools action close
• Output: RCA report, customer response, JIRA draft
• HITL: Review and approve deliverables

---

Section C: Single Phase

Run any phase independently:

/Q scan "OOM errors after upgrade"     # Phase 0 only
/Q sweep --archive ./bundle.tar.gz     # Phase 1 only
/Q trace --case CASE-001               # Phase 2 only
/Q probe "SAML redirect loop"          # Phase 3 only
/Q theorize --case CASE-001            # Phase 4 only
/Q verify --case CASE-001              # Phase 5 only
/Q close --case CASE-001               # Phase 6 only

For each single-phase invocation:

1. Load the corresponding sub-skill
2. Execute via qsTools with the appropriate action
3. Present results to user

---

Section D: Probe Only (Direct Research)

Direct access to multi-source research without investigation context:

/Q probe "SAML redirect loop after SSO migration"
/Q probe --source perplexity "kernel panic NUMA balancing"
/Q probe --source helix "prior OOM investigations"

Sources:

• helix -- SOUL vault internal knowledge (default, always searched first)
• perplexity -- Perplexity AI web search
• exa -- Exa semantic search
• tavily -- Tavily full-text extraction
• brave -- Brave independent web index

Default behavior: Search helix first, then query configured web providers in parallel.

---

Sub-Skills

Sub-skill	File	Phase	Purpose
SCAN	sub-skills/SCAN.md	0	Scene assessment, log type detection
SWEEP	sub-skills/SWEEP.md	1	Evidence collection, file extraction
TRACE	sub-skills/TRACE.md	2	Pattern forensics, timeline correlation
PROBE	sub-skills/PROBE.md	3	Multi-source research, IEEE citations
THEORIZE	sub-skills/THEORIZE.md	4	Hypothesis generation, confidence scoring
VERIFY	sub-skills/VERIFY.md	5	Solution validation, N-MultiPass
CLOSE	sub-skills/CLOSE.md	6	Deliverable generation, RCA reports
SHERLOCK	sub-skills/SHERLOCK.md	Cross	Hypothesis coherence rules
GATE	sub-skills/GATE.md	Cross	Phase gate + HITL checkpoint thresholds
CURATOR	sub-skills/CURATOR.md	Cross	Claim registration rules
ESCALATION	sub-skills/ESCALATION.md	Cross	Escalation decision trees

Quick Start

/Q                                    # Mode selection prompt
/Q "OOM errors after upgrade"         # Quick Investigation (default)
/Q full "cascading auth failures"     # Full Investigation
/Q scan --file ./system.log           # Single Phase
/Q probe "SAML redirect loop"         # Probe Only