forensics-quickref

Topics in the source

• Forensics Framework — Quick Reference
• Canonical access pattern: discover → show
• How to use this quickref
• What this framework is for
• Capability domains
• Curated discovery phrases
• Triage & acquisition
• Platform-specific analysis

This is your always-loaded directory for the AIWG forensics-complete framework. It does not list every skill. Instead, it teaches the framework's mental model and gives you curated search phrases that map to aiwg discover lookups. When you find a candidate via aiwg discover, fetch its body with aiwg show --body. Never use find, ls, Glob, or direct Read on /skills/ paths — those reflect the kernel-pivot deploy state, not the full surface. If your platform's Skill tool errors on a non-kernel skill (expected — most aren't kernel), the fallback is aiwg show, never filesystem browsing. Last-resort if aiwg itself is broken: read directly from $AIWGROOT/agentic/code/... (the canonical corpus, always present). aiwg show returns a metadata card. Inspect its outline, then fetch a needed --section "Heading" or use --body for the full instructions. Fetch required rules with --rules --with-rule-bodies before governed work. 1. Identify the capability domain the user's need belongs to 2. Pick a curated phrase from that domain (or paraphrase the user's words) 3. Run aiwg discover " " and surface the top match (or top-3) to the user 4. If the top result isn't right, iterate the phrasing — the score

This is an excerpt. Refer to the complete source and its current requirements.