Investigations

Time-bound research artifacts organized by date. Each investigation gets its own folder containing findings, scripts, and evidence.

Investigations are triggered by incidents, performance anomalies, or proactive deep dives. Once resolved, key findings should be promoted to runbooks or the knowledge base, and useful scripts should be promoted to scripts/.

See TEMPLATE.md for the standard investigation format.