Core principle

ALWAYS find root cause before attempting fixes. Symptom fixes are failure.

Violating the letter of this process is violating the spirit of debugging.

The Iron Law

NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST

If you haven't completed Phase 1, you cannot propose fixes.

Workflow: The Five Phases

You MUST complete each phase before proceeding to the next.

Phase 0: Context Gathering (MANDATORY)

BEFORE investigating, ensure you understand the problem space.

STOP and ASK if any of these are unclear. Use AskUserQuestion tool.

1. Categorize the Problem Type

Type	Key Questions to Ask
Bug/Error	What is the expected vs. actual behavior? Can you reproduce it?
Security	Threat model? Internal or external attacker? What permissions do they have?
Performance	What metric? What's acceptable? Where does it degrade?
Integration	Which systems are involved? What are the boundaries?

2. Clarify Scope and Assumptions

Always ask yourself:

What am I assuming that might be wrong?
What context is the user not telling me?
What would change my approach if I knew more?

For Security Analysis specifically:

Who is the attacker? (Anonymous user, authenticated user, admin, insider?)
What permissions/access do they START with?
What is the target? (Data, privileges, availability?)
Internal network access or external only?
What's already been ruled out?

3. Ask Clarifying Questions

Examples of good clarifying questions:

"Welche Berechtigungen hat der User bereits?"
"Geht es um einen externen Angreifer oder einen authentifizierten User?"
"Was genau soll geschützt werden?"
"Gibt es bekannte Einschränkungen oder Annahmen?"

Red Flag: If you're about to spawn 3 agents but can't clearly state the problem in one sentence → STOP and clarify first.

Phase 1: Root Cause Investigation

BEFORE attempting ANY fix:

MANDATORY: Verwende das Task-Tool mit subagent_type="general-purpose" für diese 3 Agenten. Spawne alle 3 in einem einzigen Message-Block (parallel). Each performs the same complete investigation independently:

Read Error Messages Carefully
- Don't skip past errors or warnings
- They often contain the exact solution
- Read stack traces completely
- Note line numbers, file paths, error codes
Reproduce Consistently
- Can you trigger it reliably?
- What are the exact steps?
- Does it happen every time?
- If not reproducible → gather more data, don't guess
Check Recent Changes
- What changed that could cause this?
- Git diff, recent commits
- New dependencies, config changes
- Environmental differences

Gather Evidence in Multi-Component Systems

WHEN system has multiple components (CI → build → signing, API → service → database):

BEFORE proposing fixes, add diagnostic instrumentation:

For EACH component boundary:
  - Log what data enters component
  - Log what data exits component
  - Verify environment/config propagation
  - Check state at each layer

Run once to gather evidence showing WHERE it breaks
THEN analyze evidence to identify failing component
THEN investigate that specific component

Example (multi-layer system):

# Layer 1: Workflow
echo "=== Secrets available in workflow: ==="
echo "IDENTITY: ${IDENTITY:+SET}${IDENTITY:-UNSET}"

# Layer 2: Build script
echo "=== Env vars in build script: ==="
env | grep IDENTITY || echo "IDENTITY not in environment"

# Layer 3: Signing script
echo "=== Keychain state: ==="
security list-keychains
security find-identity -v

# Layer 4: Actual signing
codesign --sign "$IDENTITY" --verbose=4 "$APP"

This reveals: Which layer fails (secrets → workflow ✓, workflow → build ✗)

Trace Data Flow

WHEN error is deep in call stack:

See root-cause-tracing.md in this directory for the complete backward tracing technique.

Quick version:
- Where does bad value originate?
- What called this with bad value?
- Keep tracing up until you find the source
- Fix at source, not at symptom
After all 3 agents complete (~60s):

Compare findings
3/3 agree → High confidence (0.9+)
2/3 agree → Medium confidence (0.7)
Disagreements → Review manually
Combine unique findings from all agents
Synthesize final root cause

CRITICAL: Phase Completion Gates

You MUST NOT proceed to the next phase without completing the current phase fully.

Phase 2: Pattern Analysis

Find the pattern before fixing:

MANDATORY: Verwende das Task-Tool mit subagent_type="systematic-debugging:pattern-analyzer" für diese 3 Agenten. Spawne alle 3 in einem einzigen Message-Block (parallel). Each agent performs the same complete investigation independently:

Find Working Examples
- Locate similar working code in same codebase
- What works that's similar to what's broken?
Compare Against References
- If implementing pattern, read reference implementation COMPLETELY
- Don't skim - read every line
- Understand the pattern fully before applying
Identify Differences
- What's different between working and broken?
- List every difference, however small
- Don't assume "that can't matter"
Understand Dependencies
- What other components does this need?
- What settings, config, environment?
- What assumptions does it make?

Phase 3: Hypothesis and Testing

Scientific method:

Form Single Hypothesis
- State clearly: "I think X is the root cause because Y"
- Write it down
- Be specific, not vague
Test Minimally
- Make the SMALLEST possible change to test hypothesis
- One variable at a time
- Don't fix multiple things at once
Verify Before Continuing
- Did it work? Yes → Phase 4
- Didn't work? Form NEW hypothesis
- DON'T add more fixes on top
When You Don't Know
- Say "I don't understand X"
- Don't pretend to know
- Ask for help
- Research more

Phase 4: State the root cause

summarize your findings and ask the senior architect skills for possible soulutions

Red Flags - STOP and Follow Process

If you catch yourself thinking:

"Quick fix for now, investigate later"
"Just try changing X and see if it works"
"Add multiple changes, run tests"
"Skip the test, I'll manually verify"
"It's probably X, let me fix that"
"I don't fully understand but this might work"
"Pattern says X but I'll adapt it differently"
"Here are the main problems: [lists fixes without investigation]"
Proposing solutions before tracing data flow
"One more fix attempt" (when already tried 2+)
Each fix reveals new problem in different place

ALL of these mean: STOP. Return to Phase 1.

If 3+ fixes failed: Question the architecture (see Phase 4.5)

your human partner's Signals You're Doing It Wrong

Watch for these redirections:

"Is that not happening?" - You assumed without verifying
"Will it show us...?" - You should have added evidence gathering
"Stop guessing" - You're proposing fixes without understanding
"Ultrathink this" - Question fundamentals, not just symptoms
"We're stuck?" (frustrated) - Your approach isn't working

When you see these: STOP. Return to Phase 1.

Common Rationalizations

Excuse	Reality
"Issue is simple, don't need process"	Simple issues have root causes too. Process is fast for simple bugs.
"Emergency, no time for process"	Systematic debugging is FASTER than guess-and-check thrashing.
"Just try this first, then investigate"	First fix sets the pattern. Do it right from the start.
"I'll write test after confirming fix works"	Untested fixes don't stick. Test first proves it.
"Multiple fixes at once saves time"	Can't isolate what worked. Causes new bugs.
"Reference too long, I'll adapt the pattern"	Partial understanding guarantees bugs. Read it completely.
"I see the problem, let me fix it"	Seeing symptoms ≠ understanding root cause.
"One more fix attempt" (after 2+ failures)	3+ failures = architectural problem. Question pattern, don't fix again.

Quick Reference

Phase	Key Activities	Success Criteria
1. Root Cause	Read errors, reproduce, check changes, gather evidence	Understand WHAT and WHY
2. Pattern	Find working examples, compare	Identify differences
3. Hypothesis	Form theory, test minimally	Confirmed or new hypothesis
4. Implementation	Create test, fix, verify	Bug resolved, tests pass

When Process Reveals "No Root Cause"

If systematic investigation reveals issue is truly environmental, timing-dependent, or external:

You've completed the process
Document what you investigated
Implement appropriate handling (retry, timeout, error message)
Add monitoring/logging for future investigation

But: 95% of "no root cause" cases are incomplete investigation.

Supporting Techniques

These techniques are part of systematic debugging and available in this directory:

root-cause-tracing.md - Trace bugs backward through call stack to find original trigger
defense-in-depth.md - Add validation at multiple layers after finding root cause
condition-based-waiting.md - Replace arbitrary timeouts with condition polling

Related skills:

superpowers:test-driven-development - For creating failing test case (Phase 4, Step 1)
superpowers:verification-before-completion - Verify fix worked before claiming success