investigation-controller¶

Two engines in one binary. The gate admits findings that are Enhanced, have a closed accumulation window, and are older than --finding-min-age; admission materializes the Repository (if absent) and one immutable Investigation per attempt — the child create is the lease. The analysis scheduler then runs agent Jobs under bounded concurrency in severity order, parses the PATCHY-EVENT: stream, stamps the results, and routes the verdict onto the Finding.

investigation-controller serve --namespace patchy \
  --claude-agent-image ghcr.io/bitwise-media-group/patchy/claude-agent-runner:v0.9.0 # match your installed release

Pipeline flags¶

The shared flags, plus:

Agent Job flags¶

Shared with the remediation-controller — both job controllers build Jobs the same way, from a per-harness runner fleet. A runner is configured when its image flag is set and enabled when it is also in --harnesses (or, when that is empty, its credential Secret exists). The controller resolves each stage's model to a harness and runs the matching runner. At startup it validates that every allowlisted model has an enabled harness that supports it, refusing to start otherwise.

Stage flags¶

The investigation stage's limits are absolute — the stage runs on exactly these. Its model is a canonical, provider-qualified id (e.g. anthropic/claude-sonnet-5); the harness that runs it is derived from the model. The two remediate ceilings exist here because this controller clamps what the investigation report requests before it ever reaches the queue.

The stage flags are re-serialized into PATCHY_* environment variables injected into every investigation pod (agent-runner reads them), so this controller's flags are the single operator-facing configuration point for the analysis stage.

Verdict routing¶

When the analysis Job completes, the controller stamps the summary onto Finding.status.investigation, sets the scheduling priority, and moves the phase:

A partial report is never trusted: outcomes other than ok (runtime_error, timeout, budget_exceeded, report_missing, report_invalid) always retry or fail — they never route on whatever frontmatter survived.