😏

profiles/incident-hypothesis-triage/README.md

@@ -0,0 +1,7 @@
+# Incident Hypothesis Triage
+
+Use this featured profile for read-only production incident triage or difficult causal investigations. GLM-5.3 on the Z.AI Coding Plan synthesizes evidence; fast DeepSeek Flash performs bounded local collection; Nemotron through a pinned OpenRouter policy develops and attacks alternatives.
+
+The topology is intentionally heterogeneous and read-only. It may assert root cause only from a reproducible evidence chain; otherwise it reports ranked unresolved hypotheses and safe next probes. OpenRouter policy and serving telemetry make route claims auditable, but do not prove semantic independence or correctness.
+
+Both workers are persistent supervised Unix app-server threads. The root controls each, and evidence runner and causal challenger can steer, interrupt, pause, continue, detach, finalize, fully stop, or cancel one another through reciprocal action grants when a claim needs a sharper test. Goal tokens or clock-free turns accommodate slow providers while retained terminal history, traces, and partial evidence prevent transport loss from deleting the investigation.

profiles/incident-hypothesis-triage/agents/causal-challenger.md

@@ -0,0 +1 @@
+Independently develop alternative causal hypotheses and try to falsify each using supplied evidence. Separate observation, inference, and speculation. Give predictions that would distinguish hypotheses and evidence still needed. Never assert a root cause by confidence, consensus, or model reputation; an OpenRouter route policy reduces routing ambiguity but does not itself prove semantic independence.

profiles/incident-hypothesis-triage/agents/evidence-runner.md

@@ -0,0 +1 @@
+Collect or correlate only the bounded local evidence requested. Record exact commands, exit codes, timestamps, paths, hashes, and observations; do not change files, access the network, or decide root cause. Identify gaps and contradictions. A command claim must be present in captured tool events.

profiles/incident-hypothesis-triage/agents/incident-lead.md

@@ -0,0 +1 @@
+Remain read-only. Own the incident timeline, evidence graph, and final adjudication. Launch bounded evidence collection and the independent causal challenger early, then continue correlating supplied evidence. Read and explicitly accept or reject worker results. A root cause may be asserted only when a reproducible evidence chain distinguishes it from alternatives; otherwise publish ranked unresolved hypotheses, missing observations, and safe next probes. Treat provider failure or an unavailable challenger as visible uncertainty, not permission to invent certainty.

profiles/incident-hypothesis-triage/contracts/evidence.json

@@ -0,0 +1,37 @@
+{
+  "title": "Bounded incident evidence",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "question": {"type": "string", "minLength": 1},
+    "observations": {
+      "type": "array",
+      "maxItems": 100,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "id": {"type": "string", "minLength": 1},
+          "timestamp": {"type": ["string", "null"]},
+          "source": {"type": "string", "minLength": 1},
+          "sha256": {"type": ["string", "null"], "pattern": "^[0-9a-f]{64}$"},
+          "observation": {"type": "string", "minLength": 1}
+        },
+        "required": ["id", "timestamp", "source", "sha256", "observation"]
+      }
+    },
+    "commands": {
+      "type": "array",
+      "maxItems": 30,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {"command": {"type": "string", "minLength": 1}, "exit_code": {"type": "integer"}, "observation": {"type": "string", "minLength": 1}},
+        "required": ["command", "exit_code", "observation"]
+      }
+    },
+    "contradictions": {"type": "array", "items": {"type": "string"}, "maxItems": 30},
+    "gaps": {"type": "array", "items": {"type": "string"}, "maxItems": 30}
+  },
+  "required": ["question", "observations", "commands", "contradictions", "gaps"]
+}

profiles/incident-hypothesis-triage/contracts/hypotheses.json

@@ -0,0 +1,28 @@
+{
+  "title": "Independent causal hypotheses",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "hypotheses": {
+      "type": "array",
+      "minItems": 2,
+      "maxItems": 20,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "id": {"type": "string", "minLength": 1},
+          "claim": {"type": "string", "minLength": 1},
+          "supporting_evidence_ids": {"type": "array", "items": {"type": "string"}, "maxItems": 30, "uniqueItems": true},
+          "contradicting_evidence_ids": {"type": "array", "items": {"type": "string"}, "maxItems": 30, "uniqueItems": true},
+          "distinguishing_prediction": {"type": "string", "minLength": 1},
+          "status": {"type": "string", "enum": ["supported", "weakened", "unresolved"]}
+        },
+        "required": ["id", "claim", "supporting_evidence_ids", "contradicting_evidence_ids", "distinguishing_prediction", "status"]
+      }
+    },
+    "missing_evidence": {"type": "array", "items": {"type": "string"}, "maxItems": 30},
+    "root_cause_asserted": {"const": false}
+  },
+  "required": ["hypotheses", "missing_evidence", "root_cause_asserted"]
+}

profiles/incident-hypothesis-triage/profile.toml

@@ -0,0 +1,99 @@
+schema_version = 8
+id = "incident-hypothesis-triage"
+version = "8.0.0"
+display_name = "Incident Hypothesis Triage"
+description = "A read-only GLM incident lead combines bounded DeepSeek evidence collection with a separately routed Nemotron causal challenger."
+tags = ["incident", "causal-analysis", "provider-diversity", "read-only", "featured"]
+maturity = "featured"
+root = "incident_lead"
+smoke = "smoke.toml"
+
+[agents.incident_lead]
+kind = "root"
+description = "Read-only evidence synthesizer and final hypothesis adjudicator"
+model = "zai_coding_responses__glm_5_3"
+reasoning = "max"
+allowed_reasoning_efforts = ["high", "max"]
+execution_mode = "goal"
+goal_token_budget = 300000
+max_goal_token_budget = 500000
+stall_warning_seconds = 3600
+finalization_grace_seconds = 1200
+plan_reasoning = "max"
+permissions = "read-only"
+can_spawn = ["evidence_runner", "causal_challenger"]
+max_active = 1
+trust = "high"
+verification = "always"
+network_access = false
+web_search = "disabled"
+instructions = "agents/incident-lead.md"
+
+[agents.evidence_runner]
+description = "Fast bounded evidence collector and correlator, reusable for one follow-up query"
+model = "opencode_go_openai_chat__deepseek_v4_flash"
+reasoning = "high"
+allowed_reasoning_efforts = ["low", "high", "max"]
+execution_mode = "turn"
+stall_warning_seconds = 1800
+finalization_grace_seconds = 1200
+permissions = "read-only"
+backends = ["mcp"]
+can_spawn = []
+max_active = 2
+allowed_task_kinds = ["evidence_collection", "correlation"]
+trust = "high"
+verification = "always"
+network_access = false
+web_search = "disabled"
+contract_enforcement = "strict"
+output_contract = "contracts/evidence.json"
+instructions = "agents/evidence-runner.md"
+
+[agents.causal_challenger]
+description = "Independent causal analyst that develops and attacks alternative hypotheses"
+model = "openrouter_openai_chat__nvidia_nemotron_3_ultra_550b_a55b"
+reasoning = "high"
+allowed_reasoning_efforts = ["medium", "high"]
+execution_mode = "goal"
+goal_token_budget = 150000
+max_goal_token_budget = 250000
+stall_warning_seconds = 1800
+finalization_grace_seconds = 900
+permissions = "read-only"
+backends = ["mcp"]
+can_spawn = []
+max_active = 1
+allowed_task_kinds = ["causal_analysis", "hypothesis_review"]
+trust = "adversarial_reviewer"
+verification = "root_adjudication"
+network_access = false
+web_search = "disabled"
+contract_enforcement = "strict"
+output_contract = "contracts/hypotheses.json"
+instructions = "agents/causal-challenger.md"
+
+[agents.incident_lead.controls.evidence_runner]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[agents.incident_lead.controls.causal_challenger]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[agents.evidence_runner.controls.causal_challenger]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[agents.causal_challenger.controls.evidence_runner]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[coordination]
+mode = "evidence_gated_incident_triage"
+orchestration = "mcp"
+max_active_agents = 3
+max_depth = 1
+max_children_per_agent = 2
+max_active_writers = 0
+reject_ancestor_role = true
+wait_policy = "dependency_only"
+write_conflict_policy = "reject"
+contradiction_policy = "primary_evidence"
+result_visibility = "ancestors"

profiles/incident-hypothesis-triage/smoke.toml

@@ -0,0 +1,24 @@
+schema_version = 8
+
+[[tasks]]
+agent = "incident_lead"
+task_kind = "analysis"
+task = "Inspect the incident profile read-only and explain the evidence threshold for asserting root cause."
+mode = "read-only"
+wall_timeout_seconds = 600
+
+[[tasks]]
+agent = "evidence_runner"
+task_kind = "evidence_collection"
+task = "Collect bounded evidence about the current catalog schema version using local commands only. Return only the required incident-evidence JSON with correlated commands."
+backend = "mcp"
+mode = "read-only"
+wall_timeout_seconds = 900
+
+[[tasks]]
+agent = "causal_challenger"
+task_kind = "causal_analysis"
+task = "Given only the fact that a profile compile failed, produce at least two unresolved alternative hypotheses and distinguishing predictions. Return only the required hypotheses JSON and do not assert a root cause."
+backend = "mcp"
+mode = "read-only"
+wall_timeout_seconds = 900