Investigations
An investigation is Halon working out on its own why something is broken. It writes down its theories, tests them against your systems, and ends with an answer, the evidence behind it and a fix you can apply. See Investigations.
Starting one. Run /ff investigate in an incident channel, choose Investigate on the incident's pinned message or on its page in the dashboard, mention @Firefight with a message that starts with investigate, or ask in a chat. Agents use start_investigation and get_investigation over MCP.
Before there is an incident. In any other channel, say what is wrong, such as /ff investigate checkout returns 500 since 14:00. When the answer says users are hurt now, it offers Declare incident, and the new incident starts with what Halon found.
How it works. Halon starts from the earliest real sign of trouble and the clues in the alerts and what people said. It checks where the incident's services run on the resource map and what changed there, ranks the code changes that landed before the trouble, and reads the code itself in a sandbox of its own, at the commit that was running. Before an answer goes out, Halon is asked to prove itself wrong, and every claim is checked against what the steps it cites actually returned.
Follow along. The run's thread in Slack shows each step as it happens, and the dashboard shows the whole run, its theories marked Open, Supported or Ruled out, and every step with what it returned. The incident's timeline shows when each run started and answered. Mention @Firefight in a running investigation's thread, or use Tell Halon something in the dashboard, to add what you know without starting again. Stop ends a run after the step it is on.
Only reads. An investigation runs as Firefight Investigator, with only what you grant it under Gateway, and never changes anything in your systems. A fix it proposes waits for a person.
Rate the answer. Every answer ends with Right, Partly right and Wrong. Halon learns from answers marked wrong, and the next run that meets the same alert reads the past answers your team rated.