Incident Investigation

When an agent does something wrong, the traditional investigation is log archaeology: correlating half-structured records across systems and hoping the interesting parts were captured. CueCrux was built for the alternative: receipts are the debugging surface. Every retrieval, decision point, and state mutation the agent performed is a signed receipt on the hash-chained spine, so the investigator replays the sequence exactly as it happened, in order, with cryptographic assurance that nobody tidied it up afterwards.

Refusals sharpen the picture. If policy blocked adjacent actions, the signed RefusalReceipts show where the guardrails held, which is often the fastest way to isolate where they did not.

Timeline reconstruction extends to knowledge state: the trail records what the agent had retrieved when it acted, so "was this decision reasonable given what it knew" is answerable rather than rhetorical. Attribution comes free, since every action binds to a passport with an identity and trust tier.

The close-out is durable too: root cause and fix land as a decision record, and where the incident triggers regulatory notification, the evidence pack exports for offline verification. Investigations end with artefacts, not folklore.