Unpack Investigate Artifacts

Unpack and Investigate Artifacts

Begin with the artifact the user supplied. Do not build, install, launch, reproduce, or run any collection command. In particular, never invoke tools/diagnose.py from this skill; it consumes the package that script already produced.

Recognize an AetherKiri diagnostic bundle

Treat an existing out/diagnostics/<timestamp>-<platform>-<session>.zip or its matching directory as the primary input for this workflow. If the user says “the diagnostic package” without a path, locate the newest completed ZIP under out/diagnostics/; do not run tools/diagnose.py to create one.

After safe extraction, verify the bundle contract before interpreting it:

• root metadata.json identifies the requested session, platform, profile, Git revision, and capture mode;
• app metadata may have been merged into root metadata, while raw app files can remain under app-data/;
• root events.jsonl is the normalized cross-layer stream; check JSON validity, session IDs, sequence continuity, clock basis, and queue_dropped before sorting or filtering it;
• incidents/marker-*-pre.jsonl and marker-*-post.jsonl preserve the marker windows when the UI marker was accepted;
• incidents/marker-*-state.json captures the bounded performance, input, memory, and plugin context sampled by that one-click marker;
• attachments/state-snapshot-*.json contains explicit in-app state snapshots and attachments/screenshot-*.png contains only user-requested screenshots;
• diagnostic_self_check events report which app-side facilities were reachable, but do not prove that unrelated runtime paths were healthy;
• platform/ contains raw host/platform evidence and collection errors or omissions;
• summary.md is a generated lead, not source evidence. Re-check every material statement against the structured events and raw platform files.

An absent UI marker is not automatically a failed bundle. Check for a host marker with ui_marker_missing=true, then state which app-side boundary is unavailable. Treat a typed marker label, state snapshot, screenshot, and self-check as separate evidence with independent timestamps.

Preserve provenance

1. Record the source path, byte size, modification time, and SHA-256 before extraction.
2. Identify the format from magic and structure, not only the extension.
3. List archive members before extracting. Flag encrypted entries, absolute paths, traversal components, links, devices, surprising compression ratios, and duplicate names.
4. Extract into a new disposable directory. Never overwrite the source or extract over a working tree.

For ZIP-compatible packages and TAR archives, prefer:

python3 scripts/safe_unpack.py ARTIFACT OUTPUT_DIR --manifest OUTPUT_DIR.manifest.json

The script rejects traversal, links, special files, excessive member counts, and expanded-size limits. For unsupported formats, list with the narrowest available format-aware tool before choosing an extractor with equivalent protections.

Build an inventory

Use rg --files first, then group files by role rather than dumping every path:

• metadata and manifests;
• structured events, markers, and incident windows;
• explicit state snapshots, screenshots, self-checks, and in-app export artifacts;
• platform logs, crash reports, traces, and thread dumps;
• binaries, architectures, symbols, libraries, plugins, and signatures;
• assets, scripts, configuration, databases, and caches;
• missing, truncated, duplicated, or unexpectedly empty evidence.

Keep secrets out of output. Report the presence and location of credentials, tokens, provisioning data, or personal content without printing their values.