---
description: Investigation pipeline architecture and stage development
globs:
    - core/orchestration/**
    - core/runtime/**
    - core/domain/state/**
---

# Investigation pipeline

## Coordinator

`core/orchestration/pipeline.py` runs **resolve integrations → extract alert → investigation agent → deliver**.

`core/orchestration/entrypoints.py` exposes `run_investigation` and async streaming helpers.

## Key packages

- `core/orchestration/node/` for pipeline stages (extract, investigate, diagnose, publish findings)
- `core/runtime/` for shared LLM tool-calling runtime primitives
- `interactive_shell/chat/` for live REPL conversational assistant
- `core/domain/state/agent_state.py` for `AgentState` / `InvestigationState`
- `core/domain/state/runtime_slices.py` for investigation slice TypedDicts and stage ownership

## Conventions

- Prefer `@traceable` from `platform.observability.tracing` on externally-visible orchestration helpers.
- Stages read full state and return **partial dict** updates.
- Use `get_tracker()` for CLI progress when appropriate.
- Keep new persisted keys in the state `TypedDict` and any matching validators.