Investigation Phases Reference Documentation

Investigation Phases: Reference Documentation

The Claude Sleuth investigation workflow is a structured, 6-phase pipeline designed to transform raw leads into evidence-grade analytical products. This process is governed by the Intelligence Cycle and enforced by the task_runner.py state machine. Each phase corresponds to specific strategic goals, documentation templates, and epistemic constraints.

This page serves as a high-level directory for the reference documentation located in skills/claude-sleuth/references/.

The Intelligence Pipeline Overview

The workflow follows a sequential "Tool Dependency Map," where the output of one phase serves as the foundation for the next.

Intelligence Workflow Logic

graph TD
    subgraph "Natural Language Space (Strategic & Reporting)"
        PH1["Phase 1: Direction (oppstrat)"]
        PH6["Phase 6: Dissemination (findis)"]
    end

    subgraph "Code Entity Space (Data & Processing)"
        PH2["Phase 2: Collection (intelepi)"]
        PH3["Phase 3: Processing (colent)"]
        PH4["Phase 4: Processing (chronrel)"]
        PH5["Phase 5: Analysis (hypcog)"]
    end

    PH1 --> PH2
    PH2 --> PH3
    PH3 --> PH4
    PH4 --> PH5
    PH5 --> PH6

    %% Mapping to Code Entities
    PH2 -.->|"Source Grading"| SG["source_grader.py"]
    PH3 -.->|"Entity Linkage"| ER["entity_resolver.py"]
    PH4 -.->|"Graph Logic"| NG["network_graph.py"]
    PH5 -.->|"Logic Testing"| ACH["ach.md Template"]

Loading

---

Phase 1 — Operational Direction & Strategic Foundation (oppstrat)

Phase 1 establishes the legal and operational boundaries of the investigation. It focuses on justifying investigative vectors through the PLAN framework (Proportionality, Legality, Accountability, Necessity) and environmental assessment via STEEPLES.

• Key Templates: case-decision-log.md, investigation-strategy.md.
• Objective: Define intelligence requirements and allocate resources.

For details, see Phase 1 — Operational Direction & Strategic Foundation (oppstrat).

---

Phase 2 — Intelligence Collection & Epistemic Filtering (intelepi)

This phase focuses on gathering data while preventing "workspace poisoning." Every piece of information must be graded using the Admiralty 6x6 Matrix (Source Reliability A-F, Information Credibility 1-6) before it can inform the investigation.

• Key Templates: source-grading.md, task-log.md, evidence-register.md.
• Key Tools: source_grader.py, evidence_preservation.py.

For details, see Phase 2 — Intelligence Collection & Epistemic Filtering (intelepi).

---

Phase 3 — Collation & Entity Resolution (colent)

Raw data is transformed into structured records using the POLE (Person, Object, Location, Event) schema. This phase involves resolving fragmented identity records and maintaining a centralized Entity Register.

• Key Templates: pole.md, entity-register.md, subject-profiles.md.
• Key Tools: entity_resolver.py.

For details, see Phase 3 — Collation & Entity Resolution (colent).

---

Phase 4 — Chronological & Relational Processing (chronrel)

Data is processed to identify temporal patterns and network structures. This includes UTC normalization of timelines and the construction of network graphs to identify "Bridge Nodes" and "Central Hubs".

• Key Templates: chronological-matrix.md, network-architecture.md, verification.md.
• Key Tools: chronological_matrix.py, network_graph.py.

For details, see Phase 4 — Chronological & Relational Processing (chronrel).

---

Phase 5 — Hypothesis Reasoning & Cognitive De-biasing (hypcog)

Before reporting, findings undergo the Analysis of Competing Hypotheses (ACH). This process utilizes the Inconsistency Principle, where the most viable hypothesis is the one with the least evidence against it.

• Key Templates: ach.md.
• Objective: Mitigate confirmation bias and apply ICD 203 probabilistic language.

For details, see Phase 5 — Hypothesis Reasoning & Cognitive De-biasing (hypcog).

---

Phase 6 — Final Reporting & Dissemination (findis)

The final phase produces ICD 203-compliant briefings. Reports must use a Bottom Line Up Front (BLUF) structure and strictly separate Facts, Assumptions, and Judgments skills/claude-sleuth/SKILL.md:23.

• Key Templates: briefing.md, findings-memo.md, nim.md.
• Key Tools: report_generator.py.

For details, see Phase 6 — Final Reporting & Dissemination (findis).

---

System Integration: Data & Progress Persistence

The investigation state is synchronized between the local environment and the CSDb (Claude Sleuth Database).

State Synchronization Flow

graph LR
    subgraph "Local Workspace"
        TR["task_runner.py"]
        NB["investigation-notebook.md"]
        SP[".sleuth-progress.json"]
    end

    subgraph "CSDb (MCP Server)"
        DB[("Cloudflare D1")]
        T1["load_progress"]
        T2["save_progress"]
        T3["save_notebook"]
    end

    TR -- "Status/Next" --> SP
    TR -- "CSDb:save_progress" --> T2
    T2 --> DB
    DB --> T1
    T1 -- "Session Sync" --> SP
    NB -- "CSDb:save_notebook" --> T3
    T3 --> DB

Loading

---