Templates Investigation Workspace Documents

Templates: Investigation Workspace Documents

The claude-sleuth toolkit utilizes a structured library of 22 Markdown templates to ensure consistency, legal compliance, and analytical rigor throughout an investigation. These templates are not merely blank forms; they embed specific intelligence frameworks—such as STEEPLES, Admiralty 6x6, and ACH—directly into the workspace to guide the analyst's reasoning and data collection.

These documents are dynamically assembled by the system to create a persistent, auditable "Investigation Notebook" that tracks the evolution of a case from initial direction to final dissemination.

Template Architecture and Assembly

Templates are stored in skills/claude-sleuth/templates/ and are categorized into four functional groups: Research, Analysis, Database, and Working. The assembly of these templates into active workspace documents is handled by the template_builder.py utility, which references template-index.json to map specific investigation steps to their required document structures.

Workspace Assembly Logic

The template_builder.py script acts as the primary engine for initializing the workspace. It can assemble templates based on the current phase of the 6-phase intelligence cycle or specific task requirements.

graph TD
    subgraph "Template Storage"
        T1["Research Templates"]
        T2["Analysis Templates"]
        T3["Database Templates"]
        T4["Working Templates"]
    end

    subgraph "Logic Layer"
        TB["template_builder.py"]
        TI["template-index.json"]
        RI["reference-index.json"]
    end

    subgraph "Output Space"
        NB["Investigation Notebook"]
        TR["Task-Specific Workspace"]
    end

    TI --> TB
    RI --> TB
    T1 & T2 & T3 & T4 --> TB
    TB --> NB
    TB --> TR

Loading

---

Template Categories

The 22 templates are organized to support the sequential flow of the intelligence cycle, ensuring that the output of one phase (e.g., entity extraction) provides the structured input for the next (e.g., relationship mapping).

1. Research & Strategy Templates

These templates establish the "Direction" and "Collection" phases of the investigation. They focus on justifying the investigation's necessity and grading the reliability of incoming information.

• Key Frameworks: STEEPLES, PLAN, Admiralty 6x6, GPS/FAN.
• Primary Files: case-decision-log.md, investigation-strategy.md, source-grading.md.

For details, see Research & Strategy Templates.

2. Analysis Templates

Used during the "Processing" and "Analysis" phases, these templates transform raw data into intelligence. They enforce structured analytical techniques (SATs) to mitigate cognitive bias.

• Key Frameworks: POLE (Person, Object, Location, Event), ACH (Analysis of Competing Hypotheses), Morphological Analysis.
• Primary Files: pole.md, ach.md, chronological-matrix.md, network-architecture.md.

For details, see Analysis Templates.

3. Database & Working Output Templates

These templates manage the persistence of the investigation's state and the final communication of findings to stakeholders.

• Database Templates: Maintain the "Ground Truth" of the case (e.g., entity-register.md, evidence-register.md).
• Working Templates: Facilitate reporting and dissemination (e.g., briefing.md, nim.md, findings-memo.md).

For details, see Database & Working Output Templates.

---

Pipeline Integration

The templates are mapped to the 6-phase workflow defined in guidance.md. The task_runner.py system uses these mappings to ensure that when an analyst moves to a new task, the appropriate analytical environment is prepared.

Phase	Title	Primary Templates
Phase 1	Operational Direction	case-decision-log.md, investigation-strategy.md
Phase 2	Intelligence Collection	source-grading.md, task-log.md, evidence-register.md
Phase 3	Collation & Entity Resolution	pole.md, entity-register.md, subject-profiles.md
Phase 4	Chronological/Relational	chronological-matrix.md, network-architecture.md
Phase 5	Hypothesis Reasoning	ach.md
Phase 6	Final Reporting	briefing.md, case-summary.md, report.md

---

The Investigation Notebook

The central artifact of any claude-sleuth engagement is the Investigation Notebook. This is a consolidated Markdown file, typically initialized via working/investigation-notebook.md, that serves as the persistent workspace. It acts as the "glue" between the ephemeral LLM context and the permanent records stored in the CSDb (Persistent Investigation Database).

graph LR
    subgraph "System Input"
        T["Templates Folder"]
    end

    subgraph "Active Workspace"
        NB["Investigation Notebook"]
        subgraph "Internal Structure"
            S1["Strategic Foundation"]
            S2["Evidence Log"]
            S3["Entity Register"]
            S4["ACH Matrix"]
        end
    end

    subgraph "External Persistence"
        DB[("CSDb / D1 Database")]
    end

    T -- "template_builder.py" --> NB
    NB -- "task_runner.py" --> DB
    DB -- "Context Injection" --> NB

Loading

---