investigate-ticket

What this skill does

# Investigate Ticket

Research-only workflow — no code changes, no fixes, no PRs. Produces a structured summary with evidence, then hands off to ticket creation or the user.

## Process

1. **Gather context** — accept a ticket ID/URL, Slack thread, Datadog alert, or verbal description. If a Linear ticket exists, fetch it.
2. **Initial Datadog scan** — quick, broad search for obvious signals. The goal is orientation, not root cause. **Do not form a hypothesis yet.**
3. **Trace the full execution path** — from the entry point (controller, webhook handler, cron job), trace through **every branch, early return, and conditional** to the expected outcome. For each branch, note:
   - What condition triggers it
   - What log message it produces (exact string and structured attributes)
   - Whether a feature flag gates it (note the flag key)
     Do NOT skip branches that seem unlikely — those are where non-obvious bugs hide.
4. **Check feature flags** — if you found flags in step 3, look up each flag's current state in LaunchDarkly (see reference.md for details).
5. **Validate each branch in Datadog** — search for the exact log messages and structured attributes from the code using `@field:value` queries, not free-text. This tells you which code path was actually taken (see reference.md for search strategy).
6. **Check data state in Snowflake** — if the issue involves unexpected data or "works for some users but not others," query Snowflake to verify actual data state (see reference.md). Skip if purely code/config.
7. **Cross-reference** — check git history for recent changes. Look for related Linear tickets. Check if the issue correlates with a deploy or flag change.
8. **Summarize findings** — present a structured summary (see Findings Format in reference.md).
9. **Hand off** — ask the user what to do next:
   - Update an existing Linear ticket with findings
   - Create a new ticket (redirect to appropriate ticket skill, carrying context forward)
   - Keep findings, no ticket action

## Hard Rules

1. **Always search Datadog** before concluding. Not optional.
2. **Always include file paths and line numbers.** "The booking service" is not acceptable.
3. **NEVER implement fixes.** This is research only. If you're writing production code, STOP.
4. **Present findings before any ticket action.** The user decides next steps, not you.
5. **Don't invent root causes.** If you can't determine it from evidence, say so.
6. **Carry context forward.** When handing off to a ticket skill, pass all findings.
7. **Trace the full path before forming a hypothesis.** Walk every branch from entry point to outcome.
8. **Use structured Datadog queries, not free-text guesses.** Read the code's logger calls first.

## Red Flags — STOP If You Notice These

| You're about to...                                         | STOP and...                                                                                                         |
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Write a fix for the bug you found                          | This is investigation only — present findings first                                                                 |
| Skip Datadog because "I already understand the issue"      | Search Datadog anyway — you might find something unexpected                                                         |
| Form a root cause theory before tracing the full code path | Trace entry point → every branch → expected output first. Hypotheses from partial code reads miss early-return bugs |
| Search Datadog with free-text keywords only                | Read the code's logger calls first, then search using structured attributes (`@field:value`)                        |
| Assume the code is wrong without checking data             | Query Snowflake to verify actual data state before blaming code logic                                               |
| Ignore a feature flag in the code path                     | Look up the flag state in LaunchDarkly — it may be gating the behavior you're investigating                         |

## Cross-Referenced Skills

- `write-bug-ticket`, `write-tech-debt-ticket`, `write-feature-ticket` — for creating tickets from findings
- `datadog-investigate` — API reference for Datadog queries when no Datadog MCP is available