diagnose

Diagnose

The discipline for hard bugs. Skip phases only when there is a clear reason.

A discipline for hard bugs. Skip phases only when explicitly justified.

When exploring the codebase, use the project's domain glossary to build a clear mental model of the relevant modules, and check the ADRs for the area you are modifying.

When exploring the codebase, use the project's domain glossary to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.

Phase 1 — Build a feedback loop

This is the core skill. The rest is mechanical. If you have a fast, deterministic, agent-runnable pass/fail signal to detect this bug, you can find the cause—bisection, hypothesis testing, and instrumentation are all just consuming that signal. If you don't, staring at the code more won't help.

This is the skill. Everything else is mechanical. If you have a fast, deterministic, agent-runnable pass/fail signal for the bug, you will find the cause — bisection, hypothesis-testing, and instrumentation all just consume that signal. If you don't have one, no amount of staring at code will save you.

Spend a disproportionate amount of effort here.Be aggressive. Be creative. Refuse to give up.

Spend disproportionate effort here. Be aggressive. Be creative. Refuse to give up.

Ways to construct one — try them in roughly this order

Failing test — at any seam that can reach the bug—unit, integration, end-to-end.

At whatever seam reaches the bug — unit, integration, e2e.
Curl / HTTP script — against a running dev server.

Against a running dev server.
CLI invocation — use fixture input, and diff stdout against a known-correct snapshot.

With a fixture input, diffing stdout against a known-good snapshot.
Headless browser script (Playwright / Puppeteer) — drive the UI, and assert on DOM/console/network.

Drives the UI, asserts on DOM/console/network.
Replay a captured trace — save real network requests/payloads/event logs to disk; replay through the code path in isolation.

Save a real network request / payload / event log to disk; replay it through the code path in isolation.
Throwaway harness — start a minimal subset of the system (one service, mock dependencies), and cover the bug's code path with a single function call.

Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.
Property / fuzz loop — if the bug is "sometimes outputs wrong", run 1000 random inputs and look for a failure pattern.

If the bug is "sometimes wrong output", run 1000 random inputs and look for the failure mode.
Bisection harness — if the bug appears between two known states (commit, dataset, version), automate "start in state X, check, repeat" so that git bisect run。

If the bug appeared between two known states (commit, dataset, version), automate "boot at state X, check, repeat" so you can git bisect run it.
Differential loop — run the old version and the new version (or two configurations) on the same input and diff the output.

Run the same input through old-version vs new-version (or two configs) and diff outputs.
HITL bash script — last resort. If a human must click, use scripts/hitl-loop.template.sh to drivethem, so the loop still has structure. The captured output is fed back to you.

Last resort. If a human must click, drive them with scripts/hitl-loop.template.sh so the loop is still structured. Captured output feeds back to you.

Build the right feedback loop, and the bug is 90% fixed.

Build the right feedback loop, and the bug is 90% fixed.

Iterate on the loop itself

Treat the loop as a product. Once you havealoop, ask yourself:

Treat the loop as a product. Once you have a loop, ask:

Can it be made faster? (Cache setup, skip irrelevant initialization, narrow the test scope.)

Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)
Can you make the signal sharper? (Assert on the specific symptom, not "it didn't crash.")

Can I make the signal sharper? (Assert on the specific symptom, not "didn't crash".)
Can you make it more deterministic? (Fix time, set random seeds, isolate the filesystem, freeze the network.)

Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)

A 30-second flaky loop is barely better than no loop. A 2-second deterministic loop is a debugging superpower.

A 30-second flaky loop is barely better than no loop. A 2-second deterministic loop is a debugging superpower.

Non-deterministic bugs

The goal is not a clean reproduction buta higher reproduction rate. Trigger the loop 100 times, parallelise, add stress, narrow the time window, inject sleeps. A bug that reproduces 50% of the time is debuggable; one at 1% is not—keep raising the probability until it is debuggable.

The goal is not a clean repro but a higher reproduction rate. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.

When you genuinely cannot build a loop

Stop and say so explicitly. List what you tried. Ask the user for: (a) access to an environment that reproduces it, (b) captured artifacts (HAR files, log dumps, core dumps, timestamped screen recordings), or (c) permission to add temporary production instrumentation.Do notenter the hypothesis phase without a loop.

Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do not proceed to hypothesise without a loop.

Do not proceed to Phase 2 until you have a loop you trust.

Do not proceed to Phase 2 until you have a loop you believe in.

Phase 2 — Reproduce

Run the loop. Observe the bug appear.

Run the loop. Watch the bug appear.

Confirm:

Confirm:

The loop produces theuser-described failure mode—not another failure that happens to be nearby. Wrong bug = wrong fix.

The loop produces the failure mode the user described — not a different failure that happens to be nearby. Wrong bug = wrong fix.
The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproduces with a high enough probability to debug).

The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).
You have captured the exact symptom (error message, wrong output, slow response time) so that later phases can verify whether the fix actually solved the problem.

You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.

Do not continue before reproducing the bug.

Do not proceed until you reproduce the bug.

Phase 3 — Hypothesise

Before testing any hypothesis, first generate 3-5 ranked hypotheses. Single-hypothesis generation anchors on the first plausible idea.

Generate 3–5 ranked hypotheses before testing any of them. Single-hypothesis generation anchors on the first plausible idea.

Each hypothesis must befalsifiable: state the prediction it makes.

Each hypothesis must be falsifiable: state the prediction it makes.

Format: "If is the cause, then <changing Y> will make the bug disappear / <changing Z> will make it worse." "If is the cause, then will make the bug disappear / will make it worse."

If you cannot state a prediction, that hypothesis is just a feeling—discard or refine it.

If you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.

Show the ranked list to the user before testing. They often have domain knowledge that immediately reorders it ("we just deployed the change in item 3"), or know hypotheses they have already ruled out. A low-cost checkpoint, a huge time saver. Do not block—if the user is away, continue with your ranking.

Show the ranked list to the user before testing. They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.

Phase 4 — Instrument

Every probe must map to a specific prediction in Phase 3.Change only one variable at a time.

Each probe must map to a specific prediction from Phase 3. Change one variable at a time.

Tool preferences:

Tool preference:

Debugger / REPL inspection — if the environment supports it. One breakpoint beats ten logs.

If the env supports it. One breakpoint beats ten logs.
Targeted logs — at the boundaries that distinguish hypotheses.

At the boundaries that distinguish hypotheses.
Never "log everything and then grep".

Never "log everything and grep".

Mark every debug log with a unique prefix, for example [DEBUG-a4f2]. Then cleanup only needs a single grep. Unmarked logs are kept; marked logs are deleted.

Tag every debug log with a unique prefix, e.g. [DEBUG-a4f2]. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.

Perf branch — For performance regressions, logging is usually the wrong approach. Instead: establish baseline measurements (timing tools,performance.now(), profiler, query plan), then bisect. Measure first, fix later.

Perf branch. For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, performance.now(), profiler, query plan), then bisect. Measure first, fix second.

Phase 5 — Fix + regression test

Before fixingwrite a regression test — but only if acorrect seam。

Write the regression test before the fix — but only if there is a correct seam for it.

The correct seam is where the test covers thereal bug patternat the call site. If the only available seam is too shallow (the bug requires multiple callers but there is only a single-caller test, and a unit test cannot reproduce the chain that triggers the bug), writing a regression test there gives false confidence.

A correct seam is one where the test exercises the real bug pattern as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.

If no correct seam exists, that itself is a finding. Record it. The codebase architecture prevents the bug from being locked down. Flag this for the next phase.

If no correct seam exists, that itself is the finding. Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.

If a correct seam exists:

If a correct seam exists:

Turn the minimized reproduction into a failing test at that seam.

Turn the minimised repro into a failing test at that seam.
Watch it fail.

Watch it fail.
Apply the fix.

Apply the fix.
Watch it pass.

Watch it pass.
Re-run the Phase 1 feedback loop against the original (unminimized) scenario.

Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.

Phase 6 — Cleanup + post-mortem

Required steps before declaring done:

Required before declaring done:

The original reproduction no longer reproduces (re-run the Phase 1 loop)

Original repro no longer reproduces (re-run the Phase 1 loop)
The regression test passes (or the missing seam has been recorded)

Regression test passes (or absence of seam is documented)
All [DEBUG-...] instrumentation has been removed (grep that prefix)

All [DEBUG-...] instrumentation removed (grep the prefix)
Throwaway prototypes have been deleted (or moved to a clearly marked debug location)

Throwaway prototypes deleted (or moved to a clearly-marked debug location)
The correct hypothesis is stated in the commit / PR message — so the next debugger can learn

The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns

Then ask: what would prevent this bug? If the answer involves architectural changes (no good test seam, tangled callers, implicit coupling), hand the specifics to the /improve-codebase-architecture skill. Give the adviceafterthe fix, not before — you now have more information than you did at the start.

Then ask: what would have prevented this bug? If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the /improve-codebase-architecture skill with the specifics. Make the recommendation after the fix is in, not before — you have more information now than when you started.