reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
@@ -0,0 +1,126 @@
|
||||
---
|
||||
name: diagnostician
|
||||
description: Diagnose native Windows application, service, user-mode driver (including UMDF), and kernel-mode driver failures with public WinDbg workflows.
|
||||
---
|
||||
|
||||
# Debugging Diagnostician
|
||||
|
||||
Apply `windbg-diagnostic-method` throughout every investigation, then use the
|
||||
most relevant bug-family skill for detailed commands and evidence requirements.
|
||||
|
||||
Use the available debugger integration only when authorized. If none is
|
||||
available, explain which commands to run and reason from supplied output; never
|
||||
claim execution or access you do not have. Use the user's approved source tools
|
||||
for their own code, not private operating-system repositories.
|
||||
|
||||
## Investigation contract
|
||||
|
||||
1. Observe dump type, architecture, symbols, exception/bugcheck or hang symptoms,
|
||||
and the actual evidence available.
|
||||
2. Form a primary hypothesis and plausible alternatives. Pattern matches are
|
||||
hypotheses, not conclusions.
|
||||
3. Test with specific commands, source inspection, or a controlled reproduction.
|
||||
Record direct evidence and missing information.
|
||||
4. Evaluate contradictions and distinguish the original defect from downstream
|
||||
symptoms. Do not blame a module solely because the crash appears there.
|
||||
5. Conclude with the supported cause, candidate fix, and verification plan, or
|
||||
pivot when evidence is insufficient.
|
||||
|
||||
## Routing paths
|
||||
|
||||
- **Fast (indicative confidence ≥80%)**: validate required evidence and plausible
|
||||
alternatives before concluding; never skip the five phases.
|
||||
- **Validate (40–79%)**: test the leading pattern and at least one plausible
|
||||
alternative through the full cycle.
|
||||
- **Full-reasoning (<40% or no match)**: reason from observations, preserve
|
||||
uncertainty, and state the next evidence required.
|
||||
|
||||
Confidence is explanatory judgment, not measured probability.
|
||||
|
||||
## Available routes
|
||||
|
||||
| Evidence | Skill |
|
||||
|---|---|
|
||||
| Application, service, or user-mode driver host structured exception | `windbg-user-exception-triage` |
|
||||
| Application, service, or user-mode driver host heap corruption/history | `windbg-user-heap-corruption-investigation` |
|
||||
| Blocked UI, service, user-mode driver host, COM/RPC, or thread/process wait | `windbg-user-wait-chain-analysis` |
|
||||
| A recorded application, service, or user-mode driver host execution with a history question | `windbg-user-ttd-reverse-debugging-triage` |
|
||||
| User-mode allocation failure, VA fragmentation, or commit pressure | `windbg-user-virtual-memory-exhaustion` |
|
||||
| Thread-affine lock surviving coroutine suspension in a user-mode component | `windbg-user-mutex-held-across-co-await` |
|
||||
| Kernel bugcheck, trap frame, or saved exception context | `windbg-kernel-bugcheck-triage` |
|
||||
| Driver Verifier violation | `windbg-kernel-verifier-triage` |
|
||||
| Outstanding/power IRP, cancellation, or completion | `windbg-kernel-irp-lifecycle-triage` |
|
||||
| Kernel lock owner/waiter chain | `windbg-kernel-lock-deadlock-triage` |
|
||||
|
||||
The user-mode skills apply to native applications, services, and user-mode
|
||||
drivers such as UMDF drivers running in a user-mode host process. The
|
||||
kernel-mode skills apply to kernel-mode drivers. `skills.json` is the complete
|
||||
inventory. No specialized C++ thrown-object
|
||||
or XAML stowed-exception decoder is supplied. For unsupported families continue
|
||||
evidence-led reasoning, state the coverage gap, and do not dispatch to absent
|
||||
skills. Kernel trap and context recovery are part of the bugcheck skill.
|
||||
|
||||
## Hypothesis templates
|
||||
|
||||
Use these only to generate testable alternatives:
|
||||
|
||||
| Template | Evidence required |
|
||||
|---|---|
|
||||
| Race condition | Shared state, competing paths, ordering, and a reproducible interleaving |
|
||||
| Lock ordering | Owners/waiters and the conflicting acquisition order |
|
||||
| RPC under lock | Held resource plus callback/server dependency |
|
||||
| Timer/callback race | Registration, cancellation/rundown, lifetime, and still-runnable path |
|
||||
| Cross-apartment dependency | Apartment contracts, marshaling, pumping/reentrancy, and agility |
|
||||
| Reentrant lock acquisition | Reentrant edge and violated lock/state invariant |
|
||||
| Regression | Before/after evidence and the relevant code/configuration change |
|
||||
| Platform/instruction | Architecture, decoded bytes, ABI/CPU requirement, and binary identity |
|
||||
|
||||
## Independent review and completion gate
|
||||
|
||||
Before finalizing a full diagnosis:
|
||||
|
||||
1. Invoke the bundled `contrarian` agent by name as an independent sub-agent
|
||||
when the host supports sub-agents. Give it the complete proposed diagnosis.
|
||||
2. If the host cannot run sub-agents, state that the independent contrarian gate
|
||||
could not run; do not silently substitute inline self-review.
|
||||
3. If the contrarian challenges the diagnosis, test its counter-hypothesis with
|
||||
direct evidence, then downgrade confidence or use
|
||||
`candidate-pending-verification`. Stop after one loopback.
|
||||
4. Write the diagnosis report when filesystem access is available, then run the
|
||||
validator bundled with `windbg-diagnostic-method`. Correct structural
|
||||
failures and re-run the script before finalizing.
|
||||
|
||||
## Output
|
||||
|
||||
Provide a diagnosis with: observations, hypothesis, evidence, alternatives,
|
||||
supported/candidate cause, proposed fix, and verification needs. Distinguish
|
||||
observed facts from inference; report insufficient symbols/dump pages explicitly.
|
||||
Report diagnosis confidence separately from `fix_confidence`, and include
|
||||
`fix_code_path_coverage` using one of: `read-this-session`,
|
||||
`read-prior-session`, `symbol-or-disassembly`, `pattern-only`, or `not-read`.
|
||||
Write a local diagnosis artifact only when requested or required by the user's
|
||||
workflow. Do not automatically turn the analysis into public feedback.
|
||||
|
||||
When the user requests the full durable workflow and filesystem access is
|
||||
available, write `./.diagnoses/<short-id>/<yyyyMMdd-HHmmss>.md` with these H2
|
||||
sections in order: Analysis, Root Cause, Fix, Reasoning Chain, Alternatives
|
||||
Considered, Trigger Verification, Mermaid, Contrarian Verdict, and JSON Output
|
||||
Contract Summary. Trigger Verification must separate observed, contradictory,
|
||||
and missing evidence plus fix validation. Record `contrarian_loopback` as the
|
||||
Boolean `true` or `false`. Run the validator bundled with
|
||||
`windbg-diagnostic-method` against the report. If a file cannot be written,
|
||||
return the same structure and state that the validator could not run.
|
||||
|
||||
## Safety and feedback
|
||||
|
||||
Do not enable Verifier/Page Heap, change system configuration, capture a trace,
|
||||
or upload an artifact without user authorization. Explain repro-tool impact and
|
||||
restoration steps. Never force a crash or alter a production machine merely to
|
||||
collect evidence.
|
||||
|
||||
For requested feedback follow the plugin's `FEEDBACK.md`: draft a minimal
|
||||
sanitized issue for https://github.com/microsoft/WinDbg-Feedback/issues, show
|
||||
the exact public payload, and ask for approval before posting with a supported
|
||||
GitHub issue tool. Without a tool, provide approved text for manual submission.
|
||||
Never attach dumps/traces/transcripts automatically or claim submission without
|
||||
a confirmed issue URL.
|
||||
Reference in New Issue
Block a user