why

Files (15)

• LICENSE
• SKILL.md
• openai.yaml · agents/
• epistemics.md · references/
• investigator-prompt.md · references/
• source-playbook.md · references/
• code-archaeology.md · references/sources/
• databricks.md · references/sources/
• datadog.md · references/sources/
• incident-postmortem.md · references/sources/
• linear.md · references/sources/
• notion.md · references/sources/
• sentry.md · references/sources/
• slack.md · references/sources/
• synthesizer-prompt.md · references/

SKILL.md (first lines)

# Why

Investigate the motivation and intent behind code: what forces led to its shape, not merely what it does now.

## Operating Posture

Operate as a **careful, cautious, and precise investigator**. Be honest about what you know vs what you're inferring. Read `references/epistemics.md` for the full confidence framework and phrasing guide. The synthesizer must follow it.

## Step 1. Understand the Target and the Question

The **target** is usually a chunk of code, a pattern, a feature, or a named design decision. The **question** is usually a design rationale, a tradeoff, a motivating edge case, an external constraint, dead code, or a broad history sweep.

If the target is vague ("why do we do it this way?" with no clear referent), make your best guess from conversation context (open files, recent edits, cursor location, what was just discussed). State your interpretation briefly so the user can redirect if you're off, then proceed.

## Step 2. Establish the Code Anchor

Before investigating, build the seed context inline: file paths and line ranges, key symbols (functions, classes, constants), the last few commits touching the target, PR numbers from merge commits (pattern `(#1234)` in the subject line), and any linked ticket IDs. Run `git blame -L <start>,<end> <file>` for last-touch commits, `git log --follow -p -- <file>` for full history with patches through renames, `git log --oneline -20 -- <file>` for recent commits with PR numbers visible, and `git log -1 --format=%B <commit>` to extract PR numbers. Then pull the PR bodies and discussion for any substantive commit through the available hosting tool. With GitHub CLI: `gh pr view <number> --json title,body,author,createdAt,mergedAt,labels,closingIssuesReferences,comments,reviews`. This anchor goes to every investigator and to the synthesizer.

## Step 3. Spawn Parallel Investigators

**Default to the full investigation across evidence categories.** The goal is a complete coverage map, not a minimal one. Document the null, don't skip the search. Use parallel investigators when delegation is available and authorized. Otherwise perform the same source-specific investigations sequentially, retaining separate evidence and search records, then a distinct synthesis pass. Report that limitation; it does not justify dropping source categories. References to investigators below describe these roles, whether delegated or performed locally.

### Discovery

Before investigating, discover the available integrations through the current harness's tool inventory or discovery mechanism. MCPs, authenticated CLIs, and local records can provide evidence; do not assume a vendor-specific directory or unavailable tool exists.

Map each available evidence source to one category:

1. Source control history
2. Issue / ticket tracker
3. Long-form documents
4. Real-time team chat
5. Infrastructure observability
6. Error / exception tracking
7. Product analytics warehouse

Use git for local history and the available hosting CLI or integration for PRs. Missing history, tools, authentication, and repository access are coverage gaps, not evidence of absence. Classify other sources using integration descriptions, tool names, and resource descriptors. If a source fits several categories, choose its primary category and record the ambiguity.

Assign a separate investigation for each available source in each category. Each investigator owns one source; merge findings by category during synthesis. Include local evidence even when it has no MCP. When delegating, launch matching investigators concurrently within the harness's limits.

Give investigators access to the evidence tools they need, using supported harness capabilities. Their task is read-only: do not edit files, commit, or modify external state. If a restricted execution mode hides necessary tools, keep the no-write instruction explicit while using an authorized mode that exposes those tools.

Each investigator's prompt is `references/investigator-prompt.md` filled in, plus:
- the category playbook `references/sources/<source>.md` for the selected source, adapted from the examples in `references/source-playbook.md`
- `references/sources/incident-postmortem.md` **if the target code looks defensive** (null checks, retry logic, timeout handling, rate limiting, feature flags, egress guards, OOM handlers)
- the code anchor and the user's original question

### Investigator roster, one per available evidence category

Each category below is uniquely positioned to surface one shape of "why", shown after "Best at". Use it to know what to expect back, to name a gap when a category returns empty, and, only in the rare provably-irrelevant case, to justify a skip.

1. **Source control** (git history, available PR tools, code comments, tests). Always investigate what is available; explicitly report missing history or hosting access. Best at *implementation-time rationale captured during review*.
2. **Issue / ticket tracker** (e.g. Linear, Jira, GitHub Issues, Plane, Shortcut MCP). Best at *the product or business forcing function*. Strongest when the why is external to engineering.
3. **Long-form documents** (e.g. Notion, Confluence, Google Docs, Coda MCP). Best at *long-form design rationale*, written out before it becomes code.
4. **Real-time team chat** (e.g. Slack, Discord, Microsoft Teams, Mattermost MCP). Best at *real-time deliberation that never reached a doc*. Especially important when the source control, ticket, and doc paper trail is thin.
5. **Infrastructure observability** (e.g. Datadog, New Relic, Honeycomb, Grafana, Splunk MCP). Best at *infrastructure and runtime reality that motivated the code*. Strongest when the target reacts to an infra signal (timeouts, retries, rate limits, circuit breakers).
6. **Error / exception tracking** (e.g. Sentry, Rollbar, Bugsnag, Airbrake MCP). Best at *the specific exceptions and error trajectories that motivated defensive or corrective code*. Strongest for catch blocks, null guards, type checks, retries, and other defenses.
7. **Product analytics warehouse** (e.g. Databricks, Snowflake, BigQuery, ClickHouse, dbt, Redshift MCP). Best at *product and data reality that shaped the code*. Strongest for flag-gated code, experiment-driven ships, data migrations, and "where did this number come from" questions.

### When to skip an investigator

Only with an **explicit, written justification** that goes in the final Sources Consulted. Two valid reasons:

- **No accessible source is available for that category** in this environment. Flag it as a gap, not a choice: "Real-time team chat skipped. No accessible chat integration or local record was available."
- **The source is provably irrelevant**, not just "probably irrelevant." A high bar: "Error / exception tracking skipped. Target is a build-time script with no runtime code path."

If your scope assessment suggests a single-commit trivial target where the PR description already contains the complete answer, you may answer inline **only after** confirming all seven available category searches would be redundant. Say so explicitly. This should be rare.

## Step 4. Synthesize

Use a separate synthesizer when delegation is available and authorized, otherwise a distinct synthesis pass in the current context. It needs read access to the evidence tools for citation spot-checks, but no write authority. It gets:
1. The investigator findings, including any null results and any categories skipped with justification
2. The code anchor
3. The user's original question
4. The epistemics framework from `references/epistemics.md`
5. The synthesizer prompt template from `references/synthesizer-prompt.md`

## Step 5. Present

Present the synthesizer's output to the user. You may lightly edit for clarity or add context from the conversation, but **do not rewrite the confidence language**.

## Output Format

The structure is the one in `references/synthesizer-prompt.md`: The Question, The Code in Question, What We Found, What We Can Reasonably Infer, Competing Hypotheses, What We Don't Know, Sources Consulted, Confidence Summary. Adapt as needed, but keep the confidence separation intact, and keep Sources Consulted as one line per investigator, including the ones that returned nothing or were skipped, with the reason.

After Sources Consulted, if the user's `why` question is a precursor to changing this code, convert the lineage findings into a Preserve / Change / Avoid / Risk constraint set for planning the change.

## Common Failure Modes to Avoid

- **Recency bias**. Assuming the most recent commit is authoritative. The current shape is often the accretion of many earlier decisions. Trace back.

Tool names and schemas in the bundled playbooks are examples. Inspect the actual available tool schema and adapt queries; do not fabricate access or assume example tables or columns exist. Do not write project files.

From grugh/skills, MIT.

More from grugh/skills