[maximelb]

Documentation for the Investigation Engine (IE): a new Investigation Engine section in the nav, plus a corrected start investigation entry in the response actions reference. This refreshes the earlier draft, which only held the response action entry.

Draft, do not merge until the feature is generally available: merging publishes the site.

Pages

• Overview, Concepts (facts, signals and proof, unknown vs absent vs incomplete, runs, waves and fact packs, draft and active)
• Console (investigate, runs, approvals inbox, templates library and Install default templates, test on past alerts, make active, pause automatic actions, performance)
• Plan Templates (structure, run inputs, applies_to, validation, the default library, testing)
• Build and Tune Templates with an AI Agent (kit, draft, validate, test, refine, save as draft, a person promotes), with validated example YAML
• Policies and Autonomy (composition, autonomy modes, approvals, run identity, notifications)
• Automatic Starts (start investigation D&R action, case trigger)
• Permissions, API Reference, MCP Tools, Command Line Interface
• 8-reference/response-actions.md (corrected start investigation) and 8-reference/permissions.md (new permission families)

Notes for review

• Templates are only the organization's investigation_plan Hive records; the default library is installed content, not built-in "managed" templates.
• investigation_plan.* and investigation_policy.* are documented as explicit grants, not part of the Owner role.
• The example templates and policies were run through the engine's validator and policy parser. The two template examples in the AI-agent guide validate with no errors or warnings.
• The CLI page follows the command group's current code; it will be re-checked against the released CLI.

🤖 Generated with Claude Code

[maximelb]

Self-review (public repo, so no AI review relied on): checked each claim against the implementation. Parameters/validation (literal template and urgency, unknown keys refused) match the dr-engine action; the sensor-id coalesce default, background best-effort send with rate limit, the detection-id idempotency key, no-policy-identity refusal and unknown/unmatched template refusal match the host and the engine's trigger contract; replay recording and the mail-rule refusal are enforced in code and tests. No private repo names, internal PR references, customer names or data in the text. Link target ../4-data-queries/template-transforms.md is the one the neighbouring start ai agent section already uses. Remaining risk: it documents an unreleased feature, hence draft / do not merge until release.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Docs-only change: one new section in docs/8-reference/response-actions.md. I found one low-priority wording issue and no high- or medium-priority issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this is a draft and must not merge until the feature is released. Approval only covers the content of the text. It does not cover release timing.
• I checked the claims only against this repository's docs, because the implementation is not in this repo. The section matches the neighbouring start ai agent and extension request sections, except for the point raised inline.

Blast Radius

Only the published Response Actions reference page changes. The new relative link goes to ../4-data-queries/template-transforms.md, which exists and is already used on this page. No code, config or other pages are affected.

---

This review was generated automatically by Claude Code.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review of the docs-only change to docs/8-reference/response-actions.md. The earlier finding is fixed. I found one new low-priority wording point and no high- or medium-priority issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until the feature is released. This approval covers the text only. It does not cover release timing.
• The implementation is not in this repo, so I checked the claims only against this repository's docs.

Blast Radius

Only the published Response Actions reference page changes. The relative link ../4-data-queries/template-transforms.md is already used elsewhere on this page. No code, config or other pages are affected.

---

This review was generated automatically by Claude Code.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Docs-only PR: a new Investigation Engine section, plus changes to the response actions and permissions references and to the nav. I read all 14 changed files. I checked every relative link and #anchor in the new and changed pages against the target headings, and none are broken. I found 1 medium-priority and 3 low-priority issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until the feature is generally available. This review covers the text only. It does not cover release timing.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.
• I could not run mkdocs build --strict because pip is not available in the sandbox. The CI preview build should confirm that the new nav entries and admonitions render.

Blast Radius

• This changes the published site: a new top-level Investigation Engine nav section with 11 pages, a new start investigation entry in the Response Actions reference, and a new permission table in the Permissions reference.
• mkdocs.yml runs with strict: true, so a broken nav path would fail the site build. All 11 nav paths exist.
• The pages tell admins how to configure run identity, autonomy and API-key promotion. Mistakes there can lead readers to grant more access than they intend (see the finding on run identity).

---

This review was generated automatically by Claude Code.

[maximelb]

Self-review (public repo, no AI review relied on). Every statement was checked against the implementation (engine contract and authoring guide, gateway routes, Hive type validators, console source, D&R action, MCP server, CLI group) rather than the earlier design notes.

Verified by running the code

• The two template examples in Build and Tune Templates with an AI Agent and the four default-library templates validate against the engine's real operator catalog with no errors or warnings. The deliberately broken variant (a misspelled field and a 45-day window) produces exactly the two errors shown (unknown_field with the hosts_30d suggestion, window_outside_free_range).
• The policy examples (default, cautious, servers, low-priority) parse with the engine's policy parser.
• markdownlint-cli2 is clean and mkdocs build produces no warnings for the new pages.

Decisions where the sources disagreed (the code won)

• plan: {"auto": true} is refused by the engine for a person; the docs say to omit plan to let applies_to choose.
• The API gateway requires insight.evt.get on every route except pause and resume, including template validation; the MCP page follows the gateway.
• A write that ends in status: active is refused for any API key at the Hive. This is documented under Permissions and in the AI-agent guide.
• There is no policy editor in the console, only the effective-policy view and the pause switch; the docs say so and point to the Hive for editing.
• A D&R replay records an investigation row, not a start investigation row; the earlier entry was wrong and is fixed. Also fixed: the unverifiable coalesce_key example, the 256-byte and 64 KiB limits, the active-template and policy-identity requirements, and the suppression key.

Known gaps to re-check before this leaves draft

• Install default templates in the console and the library kit section are documented from work that is not released yet; the page describes that behavior. Re-check once released.
• The CLI page is written from the current command group (no pull request was open when written) and must be re-checked against the released CLI. In that code runs start --urgency lists low|normal|high and --auto is accepted, while the engine takes low|medium|high|critical and refuses plan.auto; the docs avoid both. The MCP investigate_start tool has the same two issues (not documented as supported).
• Availability: the feature is off by default everywhere, so the section opens with a pre-release note. Remove it at GA.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review of commit 889cdcd. That commit adds a cost note, a skeleton caveat, clearer promotion-gate wording in the AI-agent guide, finer permission wording and a rate-limit tweak. I read all 14 changed files again and checked the new anchors (policies.md#a-default-policy, permissions.md#active-templates-can-only-be-written-by-a-person). Both resolve.

The medium-priority run-identity finding in concepts.md is still open, so this stays NOT_APPROVED. The three low-priority threads are also still open. I replied on each one.

General Feedback

• api-reference.md line 57: the commit removed "per organization" from the rate-limit sentence, so the text no longer says what the limits apply to (organization, key or user). Please name the scope.
• concepts.md: the new "What a run costs" section repeats the sentence about per-use operators being off in the default policy. That sentence is already in "The free time range" just above. Please keep one copy.
• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This review covers the text only, not release timing.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section with 11 pages, a new start investigation entry in the Response Actions reference and new rows in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• These pages guide how admins set up run identity and API-key promotion. If the identity text is wrong, readers can grant more access than they mean to.

---

This review was generated automatically by Claude Code.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review of commit a57991e. All five earlier threads are fixed: the run-identity text in concepts.md and the new warning in policies.md, the status: draft advice in templates.md and mcp.md, the CLI credential note for promote, and the investigation_policy.* warning in the AI-agent guide and permissions.md. The new permissions.md#active-templates-can-only-be-written-by-a-person anchor resolves. I found one new low-priority wording conflict and no high- or medium-priority issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers the text only, not release timing.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference, and new rows in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• These pages tell admins how to set up run identity and API-key promotion. If that text is wrong, readers may grant more access than they mean to.

---

This review was generated automatically by Claude Code.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review of commit 1362694. Since a57991e, the only change is in docs/investigation-engine/permissions.md, lines 73-76. That text now says a user login in the console or in the CLI (limacharlie auth login) can write an active template. This matches cli.md lines 68-70, so the last open thread is fixed. I read all 14 changed files again and found no new high- or medium-priority issues.

General Feedback

• console.md line 210 says "An API key cannot write an active template" and does not mention the allow-api-key-promotion opt-out. It links to the Permissions section that covers the opt-out, so this is only a small gap.
• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers the text only, not release timing.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference, and new rows in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• These pages tell admins how to set up run identity, autonomy and API-key promotion. If that text is wrong, readers may grant more access than they mean to.

---

This review was generated automatically by Claude Code.

[maximelb]

Open question before this leaves draft: the API Reference page documents the investigation routes as customer-facing. In the gateway they are registered as routes meant for LimaCharlie's own services, not customers, so the API page should only ship if they are meant to be a supported public API at GA. The rest of the section (console, templates, policies, automation, MCP) does not depend on that. Also fixed: the Permissions page now says only Owner holds the investigation permissions among the preset roles.

[maximelb]

CLI page re-verified against the CLI draft PR (python-limacharlie #455, head 8fc2401): every command and option documented matches its help output. Still to fix there, and deliberately not documented: runs start --urgency lists low|normal|high (the engine takes low|medium|high|critical) and --auto is refused by the engine for a person.

[maximelb]

/lc-review

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review at d5a65a8. The last reviewed commit was 1362694. Since then, 4 commits changed 12 files: action classes that are not available yet, draft-by-default library install, per-template identity, the trigger-detection index wait, coalescing scope, gateway error codes, the stop_when semantics and the CLI exit codes. I read all 14 changed files again and checked every relative link and #anchor in the new and changed pages. The new anchors (policies.md#action-classes, templates.md#scope, templates.md#respond-and-report, automation.md#dr-rules-start-investigation, permissions.md#what-a-run-can-do) all resolve. Both anchor misses on response-actions.md (lines 208 and 341) were already on master and are outside this PR.

The new text agrees across pages. The "not available yet" classes are now handled the same way in policies.md, templates.md, permissions.md, console.md and the AI-agent examples. The draft-by-default install is consistent between templates.md, console.md and cli.md. I found one low-priority wording point and no high- or medium-priority issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers the text only, not release timing. The owner's open question about shipping the API Reference page still stands. The new "Not a public API yet" warning on that page makes the current status clear.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference and a new Investigation Engine table in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• These pages tell admins how to set up run identity (now also per template), autonomy and API-key promotion. If that text is wrong, readers may grant more access than they mean to, or expect action classes to work when they do not.

---

This review was generated automatically by Claude Code.

[maximelb]

/lc-review

[maximelb]

Self-review of the audit fixes (each finding re-checked against current engine, gateway, Hive and console code on master, and the CLI draft's branch head, before editing). Examples were validated with the engine's own validator (2 full plans, 7 policy records, the override JSON, the wave, the run-response policy object, and the plan fragments with fixtures); mkdocs build --strict passes.

High

1. Action classes: only contain.email and contain.network can act; the others are marked "not available yet" with the real failure ("not wired", action ends failed). Fixed in templates, policies (examples and table), permissions, console, index and the AI tutorial (its sample plan now proposes contain.network on a true positive).
2. Scoping: removed automatic expansion/convergence/generated searches. Scope is the template's predefined facts; conservative profile waits for a decided true positive; follow/after unused. New "Scope" section in templates.
3. D&R start vs detection visibility: engine PR Add LimaCharlie MSSP Reporting Skill with MCP Tools #19 is merged on master. Documented the bounded wait (about 30s, backoff 500ms to 5s, INVESTIGATE_TRIGGER_DETECTION_WAIT, 0 = off, unknown(not_found) after, only the trigger detection, not for people), for D&R rules and the case trigger, and in the response-actions reference.

Medium
4. Respond timing: evaluated on every snapshot, when decides; approve/auto can start before the verdict; use verdict == true_positive to hold. Fixed in templates, policies, index, concepts.
5. Coalescing: explicit coalesce_key only, scoped to org + starter + run identity; idempotency scoped and retention-bound. Fixed in concepts, API, automation, response-actions.
6. Install defaults: Draft by default whatever the library recommends, per-row Active, confirmations, replace/demote, current/changed outcomes (console, templates; CLI and API notes).
7. Console action controls: Approve is refused in Suggest mode; "Outcome uncertain" no longer promises working Revert/Confirm (engine only accepts them on active/confirmed).
8. Template query on policy preview: dropped from the console, policies, API and CLI text (the gateway ignores it today); launcher "Run as" notes the org-wide choices.
9. Approver list: Approve and Deny only; revert/extend/confirm need only the gateway permissions (permissions, policies, console, API, CLI).
10. CLI --strict: refuses overriding values that would loosen the policy; does not fail on unknowns. Exit codes 2/3/4/5/1 documented, including a Hive-rejected promotion. Re-read the branch head (5a4302f) before writing; its --strict help text still says "any unknown" (CLI bug, documented as the engine behaves).
11. MCP investigate_test_plan needs investigation.get too (polling/test_id); "nothing more" replaced by gateway permissions plus data-source permissions (sensor.list for org_roster, sensor.task/output.set for live reads).
12. stop_when: unknown never true; incomplete facts can establish monotone positives (not absence/exact counts); evaluated before compaction (API, MCP).
13. Gateway error contract: error_code only for engine failures; gateway-only 401 (missing permission), 400, 403 (no key id), 413/414/415 listed.

Low
14. Evidence-only false positive also waits for mandatory checks (concepts).
15. identity.default not mandatory: per-template identity.templates.<name>.default works; case trigger with template: auto still needs the org-wide one (automation, policies, response-actions, concepts).
16. Runs list refreshes only while the first page has a live run (console).
17. API page now opens with "Not a public API yet": private-registry routes used by the console, CLI and MCP, not in the public OpenAPI, no stability promise; both the gateway and the datacenter must have it enabled.
18. Run response example uses policy.applied; retry (events and test polling are sent once) and key-id (every route) corrections.
19. MCP dry run: result retained 24h; save accepts status: draft, refuses active/other statuses and aliases (anchors not claimed).
20. API-key active-write refusal qualified as the default (opt-out tag) in CLI and MCP.
21. CLI list example no longer promises library discovery (kit --section library added); the hypothetical host-activity example renamed to a placeholder.

Also: run --mode default is full (test default triage), fixed one markdownlint blank-line failure, and addressed the /lc-review low finding (reference permissions note stated once for all ten permissions). Not documented on purpose: CLI runs start --urgency choices and --auto (both being fixed on the CLI side).

[limacharlie-event-notifications]

AI Code Review Summary

Re-review at 66ee64f. The last reviewed commit was d5a65a8. Since then, two commits changed two files. docs/8-reference/permissions.md now says once, above the table, that no preset role holds any investigation_plan.* or investigation_policy.* permission, and the two per-row notes are gone. docs/investigation-engine/console.md loses a double blank line. The new sentence matches the warning in docs/investigation-engine/permissions.md (lines 11-13), so the last open thread is fixed. I found no high- or medium-priority issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers the text only, not release timing. The owner's open question about whether the API Reference page should ship at GA is still open.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference, and a new Investigation Engine table in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• These pages tell admins how to grant plan and policy permissions, set up run identity, and control API-key promotion. If that text is wrong, readers may grant more access than they mean to.

---

This review was generated automatically by Claude Code.

[limacharlie-event-notifications]

AI Code Review Summary

Re-review at e23a324. Since 1362694 the commits touch 12 pages (identity per template, draft-by-default install, CLI exit codes, retry wait for the trigger detection, preset-role wording). I read all 14 changed files again. All relative links and #anchors in the section and in the two reference pages still resolve, and the nav paths exist.

I found 1 medium-priority and 1 low-priority issue. Both come from the same root cause: the run-identity fix on Concepts and Policies was not carried over to the pages for agents and keys. Those pages still say a run uses the key's own permissions.

General Feedback

• policies.md "A default policy" sets contain.network to mode: auto, and concepts.md calls it "a typical policy". The tip just above says to start in suggest. If an admin copies the first block as is, network isolation runs on its own. Consider showing the cautious suggest policy first, or adding a comment on the auto line.
• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This review covers the text only, not release timing.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference, and new rows in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths and anchors resolve.
• These pages tell admins which permissions to give agent keys and which identity runs use. If that text is wrong, readers will misjudge what an agent key can cause, for example a containment action.

---

This review was generated automatically by Claude Code.

[limacharlie-event-notifications]

AI Code Review Summary

Re-review at 66ee64f. The last reviewed commit was d5a65a8. Since then, two commits changed two files:

• docs/8-reference/permissions.md now says once, above the table, that no preset role holds any investigation_plan.* or investigation_policy.* permission. The per-row notes are gone. This fixes the last open thread.
• docs/investigation-engine/console.md loses a double blank line.

I read all 14 changed files again. The role wording now agrees across 8-reference/permissions.md, investigation-engine/permissions.md, templates.md and build-templates-with-ai.md. No double blank lines are left in the changed pages. I found no new issues.

General Feedback

• Reviewer instructions: items 1 to 21 were part of d5a65a8, which the last review covered. The implementation is not in this repo, so I checked those claims only for consistency across these pages, not against engine, gateway, Hive or CLI code. The instructions asked no questions and did not ask me to skip anything.
• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers only the text, not release timing. Your open question on whether to ship the API Reference page is still open.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference and a new Investigation Engine table in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• These pages tell admins how to grant the plan and policy permissions, set run identity and set up API-key promotion. If that text is wrong, readers may grant more access than they mean to.

---

This review was generated automatically by Claude Code.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review at 72de9b1. The last commit changes three files: mcp.md, build-templates-with-ai.md and policies.md. It fixes the two run-identity threads from the e23a324 review. It also adds a warning above the auto example in "A default policy", which covers the general feedback from that review. I read all 14 changed files again. The policies.md#run-identity anchor resolves. The "cautious one below it" now points to the suggest policy at line 98. The long line in mcp.md is fine because the repo's markdownlint config turns off MD013. I found no new issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers only the text, not when it is released. Your open question on whether the API Reference page should ship at GA is still open.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference, and a new Investigation Engine table in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• These pages tell admins which permissions to give agent keys, which identity a run uses, and how autonomy is set. If that text is wrong, readers may grant more access than they mean to.

---

This review was generated automatically by Claude Code.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review at 881b4c2. The last reviewed commit was 72de9b1. One commit changed 8 pages: LLM budget wording, draft library versions, urgency derivation, dismiss_at direction, before: semantics, console role presets, the 24h test retention, 502/503/504 for unavailable backends, inputs-only starts, CLI --auto and --template flags, and CLI exit codes. I read all 14 changed files again. The new anchors (policies.md#two-match-scopes, api-reference.md#errors) resolve. The library is now described as drafts the same way in templates.md, console.md and mcp.md. I found 2 low-priority issues and no high- or medium-priority issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers only the text, not when it is released. Your open question on whether the API Reference page should ship at GA is still open. This commit also brings back the template query on /policy/effective, which the earlier audit said the gateway ignored. Please re-check that against the released gateway.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference, and a new Investigation Engine table in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths and anchors resolve.
• The new preset-role text in permissions.md says the console's Administrator preset can use the engine with no further grant. If that is wrong in either direction, admins will grant too much or too little.

---

This review was generated automatically by Claude Code.

[limacharlie-refractionpoint]

LimaCharlie Cloud Security — code scan

No new code findings were introduced by this pull request.

This check reports and never fails: no gating.fail_on is set on the code_scanning policy.

Scanned refractionPOINT/documentation 9ba90e2…f977ee8 — only findings new in the head commit are listed; anything already on the base branch is the repository's own finding set, on the Cloud Security Code page.

This comment is updated in place on every push to this pull request.

[maximelb]

Round-2 audit mapping (14 findings, each re-checked against current origin/master before the fix; CLI page checked against python-limacharlie #455 head 5e20b76b, lc-approval SUCCESS).

#	Finding	Fix
1	before: reversed (templates.md)	Now "this step is a prerequisite of the named class on the same target", with the suggest/off/denied cases (actions.go prereq)
2	LLM budget not a hard cap (concepts.md)	Stops further launches once recorded cost reaches it; in-flight overshoot; unpriced calls add nothing to dollars
3	Suggest proposal cannot be unlocked (console.md)	Proposal keeps its mode; start a NEW run on an active template
4	Test needs investigation.get (console.md)	Added; also build-templates-with-ai.md key table (review thread)
5	CLI promotion exit code (cli.md)	Checked on 5e20b76b: Hive 400 (INVALID or UNAUTHORIZED) exits 1, only real 401/403 exits 2; reproduced against the head. Exit-code paragraph rewritten; also --auto, --category/--severity/--priority/--tag, --urgency enum, policy get --template
6	Template-aware policy preview stale (console.md)	Lookup and Run as now template-aware; alternatives are the policy's allowed identities
7	Frontend presets (permissions.md)	Server roles: Owner only; console presets also list Administrator and Operator; Operator lacks full insight.evt.get
8	Added inputs identity (permissions.md)	Steps run as the run's execution identity
9	"Stores nothing" (permissions.md, console.md)	No run/case/action; result retained 24h
10	dismiss_at direction (policies.md)	Lowered, other thresholds raised
11	Library versions/status (templates.md, mcp.md, console.md)	Versions 3/3/5/4, all status: draft; mcp/console wording updated
12	Urgency and asset tags (concepts.md)	Priority/severity only; trigger tags can match run-scoped policy records
13	Unavailable backend is not always 404 (api-reference.md)	404 only for a gateway without the routes; 503/502/504 otherwise
14	Raw start inputs-only (api-reference.md)	Inputs plus explicit plan.template accepted; also template query on /policy/effective

No fenced example changed, so the earlier example validation still applies; strict mkdocs build passes. The template query on /policy/effective is verified against lc_api-go master, not a released gateway.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review at 7b1e060. The last reviewed commit was 881b4c2. One commit changed two files. Both low-priority threads from the last review are fixed:

• build-templates-with-ai.md line 42 now lists investigation.get for testing, which matches console.md and mcp.md.
• cli.md lines 24-38 now name the save refusals that exit 4 (CLI-side validation, existing record, active template). They also say that Hive refusals arrive as HTTP 400 and exit 1, and that "status": 403 is only a label in the error document.

I read all 14 changed files again. I found one new low-priority inconsistency and no high- or medium-priority issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers only the text, not when it ships. Your open question on whether the API Reference page should ship at GA is still open. The template query on /policy/effective still needs a check against the released gateway.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference, and a new Investigation Engine table in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• The CLI exit-code text is something scripts will rely on. If it is wrong, automation may treat a Hive refusal as success or as the wrong kind of failure.

---

This review was generated automatically by Claude Code.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review at 1df1124. The last reviewed commit was 7b1e060. One commit changed one line: the templates save row in docs/investigation-engine/cli.md (line 70). It now says the CLI's own refusals exit 4 and Hive refusals exit 1. This matches the exit-code paragraph at lines 24-38 and fixes the last open thread. I found no new issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers only the text, not when it ships. Two items are still open: your question on whether the API Reference page should ship at GA, and checking the template query on /policy/effective against the released gateway.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference, and a new Investigation Engine table in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• Scripts may rely on the CLI exit codes described here. If they are wrong, automation may misread a Hive refusal.

---

This review was generated automatically by Claude Code.

[maximelb]

/lc-review

[limacharlie-event-notifications]

AI Code Review Summary

Re-review at f977ee8. The last reviewed commit was 1df1124. One commit changed two files: permissions.md and mcp.md now document a new sensor.task.read permission for live sensor reads. I read all 14 changed files again. I found 3 low-priority issues in the new text and no high- or medium-priority issues.

General Feedback

• No test-time-budget check run was found for this commit. master does not require that check in branch protection or rulesets.
• The PR body says this must not merge until GA. This approval covers only the text, not when it ships. Two items are still open: whether the API Reference page should ship at GA, and checking the template query on /policy/effective against the released gateway. sensor.task.read should also be checked against the released permission list before GA.
• The implementation is not in this repo. I checked the claims only for consistency across these pages.

Blast Radius

• Only the published docs site changes: a new Investigation Engine nav section (11 pages), a new start investigation entry in the Response Actions reference, and a new Investigation Engine table in the Permissions reference. mkdocs.yml uses strict: true, and all nav paths exist.
• The new text tells admins how to build an observe-only run identity. If the scope of sensor.task.read or its gate is unclear, admins may grant sensor.task when they did not need to, or grant sensor.task.read and find that no live reads work.

---

This review was generated automatically by Claude Code.

[limacharlie-event-notifications]

Low Priority: The last sentence lost what it refers to. "Without them" now follows "Action permissions in the table above are unchanged", so it reads as if missing action permissions make a fact unknown. It should refer to the sensor-read permissions. Move the sentence back next to them.

Suggested change

	contents, scripts, mutations and unknown commands are refused server-side. For an
	observe-only policy identity, grant `sensor.task.read` instead of `sensor.task` and
	keep actions at `suggest`. Action permissions in the table above are unchanged. Without them the fact is `unknown`, never "absent".
	contents, scripts, mutations and unknown commands are refused server-side. Without
	`sensor.task.read` (or `sensor.task`) and `output.set` the fact is `unknown`, never "absent".
	For an observe-only policy identity, grant `sensor.task.read` instead of `sensor.task` and keep actions at `suggest`. Action permissions in the table above are unchanged.

[limacharlie-event-notifications]

Low Priority: INVESTIGATION_ENGINE_ENABLED is the MCP server startup variable on mcp.md line 10. Here it reads as the switch that makes sensor.task.read work on the server. Customers cannot set a server-side flag. A reader may think that setting the MCP variable turns the permission on. If this is a platform-side gate, describe it by its effect instead, for example: "It works only while the Investigation Engine is enabled for the organization; otherwise it permits no tasking." mcp.md line 28 ("when enabled") has the same problem. Its "enabled" does not say what must be enabled.

[limacharlie-event-notifications]

Low Priority: The engine pages now point admins to sensor.task.read, but this reference page does not list it. It is missing from this Investigation Engine table and from the Sensors table near the top. Admins who look up permissions here will not find it. Add a row, for example:

| sensor.task.read | Allowlisted read-only live sensor metadata reads used by the Investigation Engine. Explicit grant only, in no preset role. |