Architecture Overview The 6 Phase Intelligence Cycle

Architecture Overview: The 6-Phase Intelligence Cycle

The Claude Sleuth architecture is built upon a formal 6-phase, 15-step, 56-task pipeline designed to transform raw investigative leads into evidence-grade analytical products. This cycle enforces professional rigor through a "Tool Dependency Map," where the output of one phase serves as the mandatory foundation for the next.

The 6-Phase Pipeline

The investigation moves through a sequential flow, governed by the task_runner.py state machine. Each phase is mapped to a specific directory within skills/claude-sleuth/references/ containing phase-specific guidance.

Phase	Title	Cycle Stage	Key Frameworks
1	oppstrat	Direction	STEEPLES, PLAN, Case Decision Log
2	intelepi	Collection	Admiralty 6x6, SHA-256 Hashing, WARC
3	colent	Processing	POLE, Fellegi-Sunter, Entity Resolution
4	chronrel	Processing	UTC Normalization, DiGraph, Centrality
5	hypcog	Analysis	ACH, Inconsistency Principle, ICD 203
6	findis	Dissemination	BLUF, NIM, Executive Briefing

---

Technical Data Flow & Implementation

The architecture bridges "Natural Language Space" (the analyst's reasoning) and "Code Entity Space" (scripts and database records) through the config.py orchestration layer.

Phase-to-Code Mapping

The following diagram illustrates how the task_runner.py uses config.py to activate specific Python scripts and Markdown templates based on the current STEP_TO_PHASE mapping.

graph TD
    subgraph "Task Control (scripts/task_runner.py)"
        TR_START["next command"] --> TR_STATE[".sleuth-progress.json"]
        TR_STATE --> TR_CONFIG["config.py lookup"]
    end

    subgraph "Phase 1-2: Direction & Collection"
        P1_2["PHASES['oppstrat' / 'intelepi']"]
        S3["STEP_SCRIPTS[3]"] --> SG["source_grader.py"]
        S5["STEP_SCRIPTS[5]"] --> EP["evidence_preservation.py"]
    end

    subgraph "Phase 3-4: Collation & Processing"
        P3_4["PHASES['colent' / 'chronrel']"]
        S6["STEP_SCRIPTS[6]"] --> ER["entity_resolver.py"]
        S9["STEP_SCRIPTS[9]"] --> CM["chronological_matrix.py"]
        S10["STEP_SCRIPTS[10]"] --> NG["network_graph.py"]
    end

    subgraph "Phase 5-6: Analysis & Reporting"
        P5_6["PHASES['hypcog' / 'findis']"]
        S13["STEP_SCRIPTS[13]"] --> RG["report_generator.py"]
    end

    TR_CONFIG --> P1_2
    TR_CONFIG --> P3_4
    TR_CONFIG --> P5_6

Loading

---

The Task Runner as the Hard Gate

The task_runner.py acts as the enforcement mechanism for the pipeline. An investigator cannot advance to a new phase or task without calling the done command, which verifies the completion of the current task's requirements.

State Transition Logic

1. next: Reads the current task brief from the task files (e.g., t1.1.md) and identifies required resources defined in STEP_SCRIPTS and STEP_TEMPLATES.
2. execute: The analyst runs the prescribed scripts and populates templates via template_builder.py.
3. done: Validates the checklist and persists the state to .sleuth-progress.json and the CSDb via save_progress.

sequenceDiagram
    participant A as Analyst (Claude/User)
    participant TR as task_runner.py
    participant DB as CSDb (MCP Server)
    participant FS as File System

    A->>TR: python3 task_runner.py next
    TR->>FS: Read task metadata
    TR->>A: Display task brief & required scripts
    A->>FS: Execute scripts (e.g., entity_resolver.py)
    A->>FS: Populate templates (e.g., pole.md)
    A->>TR: python3 task_runner.py done
    TR->>DB: CSDb:save_progress
    TR->>FS: Update .sleuth-progress.json
    TR->>A: Advance to next Task ID

Loading

---

Detailed Phase Descriptions

Phase 1: Operational Direction (oppstrat)

Focuses on scoping and legal justification. It utilizes the STEEPLES framework (Social, Technical, Economic, Environmental, Political, Legal, Ethical, Safety) and PLAN (Proportionality, Legality, Accountability, Necessity) to justify investigative vectors README.md:95.

• Key Files: research/case-decision-log.md, research/investigation-strategy.md.

Phase 2: Intelligence Collection (intelepi)

Implements an epistemic filter. Every claim is graded via the Admiralty 6x6 Matrix (A-F for reliability, 1-6 for credibility) using source_grader.py README.md:66, 97. Digital evidence is hashed (SHA-256) and archived skills/claude-sleuth/scripts/config.py:99.

Phase 3: Collation & Entity Resolution (colent)

Transforms raw data into POLE (Person, Object, Location, Event) records skills/claude-sleuth/references/guidance.md:21. entity_resolver.py applies the Fellegi-Sunter probabilistic framework to merge fragmented identity records README.md:99.

Phase 4: Chronological & Relational Processing (chronrel)

Dated events are UTC-normalized into a chronological matrix via chronological_matrix.py skills/claude-sleuth/scripts/config.py:103. Relationships are mapped into a DiGraph (Directed Graph) using network_graph.py to calculate centrality and PageRank README.md:101.

Phase 5: Hypothesis Reasoning (hypcog)

The cognitive checkpoint. Analysts must construct an Analysis of Competing Hypotheses (ACH) matrix skills/claude-sleuth/references/guidance.md:35. Conclusions are derived via the Inconsistency Principle, where the surviving hypothesis is the one with the least evidence against it README.md:67.

Phase 6: Final Reporting (findis)

Produces ICD 203-compliant briefings using report_generator.py. Reports must use the 7-tier probabilistic scale and separate Facts, Assumptions, and Judgements with a BLUF (Bottom Line Up Front) README.md:68, 70.

---