Agentic Troubleshooting Demo

Current Mission: HTTP Latency Troubleshooting

High latency (5-20s) observed on

http://webserver.example.local:9999

from client

CLIENT-VM.example.local

Mission Specs

Setting	Value
Target	`CLIENT-VM.example.local`
Protocol	WinRM over NTLM
Work Mode	Planning & Read-Only. Do not make system changes.

Security & Authorization (CRITICAL)

Auth Source: Local vault credentials file (e.g.,
```
vault.json
```
)
Zero Trust Data Flow:
1. READ: Use tools (MCP/Python) to read credentials locally.
2. SET (In Memory): Immediately set the token as a process-level environment variable (e.g.,
```
$env:VAULT_TOKEN
```
  ).
3. EXECUTE: Scripts must ONLY reference the environment variable (e.g.,
```
$env:VAULT_TOKEN
```
  ).
STRICT PROHIBITIONS:
- NEVER paste the actual token string into a
```
.ps1
```
  or
```
.py
```
  file.
- NEVER pass the token as a command-line argument (it shows up in logs).
- NEVER output the token value to the chat.

Execution Plan

Init & Auth: Initialize
```
/docs/troubleshooting_plan.md
```
and authenticate via Vault MCP.
APPROVAL GATE: Present the full plan and ask, "Shall we proceed?" Wait for user confirmation before running any scripts.
Reproduction: Attempt to reproduce latency and summarize findings.
Capture: Use native Windows 10 tools to capture traffic to
```
captures/<timestamp>_http_latency.pcapng
```
.
Scripting: Execute PowerShell scripts to isolate Client vs. Server.
Analysis: Analyze pcap locally and update the Final Report.

Operational Standards

Tools & Paths

TShark (Wireshark):
```
C:\Program Files\Wireshark\tshark.exe
```

Documentation Standards

Timestamp Format: ALL logs, tables, and filenames must use ISO 8601 (
```
YYYY-MM-DD HH:MM:SS
```
). Never use date only.
Evidence: Every "Result" in a plan must reference a specific file or log line.

File Architecture

```
scripts/simple-troubleshooting/
```
: Place all WMF 5.1 compatible scripts here.
- Naming:
```
01_desc.ps1
```
  ,
```
02_desc.ps1
```
  (Order matters).
```
docs/
```
: Living documentation.
- Required Table Columns:
```
Timestamp
```
  |
```
Host
```
  |
```
Action
```
  |
```
Result
```
  |
```
Evidence
```
- Host Definitions:
  - ```
  Local-Agent
```
  : The machine running the LLM/Prompt (e.g., creating plans, local analysis).
- ```
<TargetName>
```
    : The remote machine where the script executed.
```
captures/
```
: PCAP output files (Prefix with datetime).

Coding Guidelines

PowerShell:
- Target WMF 5.1 compatibility.
- Output: Scripts must return objects (not text) containing
```
Timestamp
```
  ,
```
Action
```
  , and
```
Result
```
  .
- Use
```
Write-Verbose
```
  for logging.
Python:
- Use
```
subprocess.run
```
  instead of
```
os.system
```
  .
- Implement retry loops (3 attempts) for external API/Network calls.

Current Mission: HTTP Latency Troubleshooting

High latency (5-20s) observed on

http://webserver.example.local:9999

CLIENT-VM.example.local

Setting	Value
Target	`CLIENT-VM.example.local`
Protocol	WinRM over NTLM
Work Mode	Planning & Read-Only. Do not make system changes.

Auth Source: Local vault credentials file (e.g.,

vault.json

)

Zero Trust Data Flow:

READ: Use tools (MCP/Python) to read credentials locally.
SET (In Memory): Immediately set the token as a process-level environment variable (e.g.,
```
$env:VAULT_TOKEN
```
).
EXECUTE: Scripts must ONLY reference the environment variable (e.g.,
```
$env:VAULT_TOKEN
```
).

STRICT PROHIBITIONS:

NEVER paste the actual token string into a
```
.ps1
```
or
```
.py
```
file.
NEVER pass the token as a command-line argument (it shows up in logs).
NEVER output the token value to the chat.

Init & Auth: Initialize

/docs/troubleshooting_plan.md

and authenticate via Vault MCP.

APPROVAL GATE: Present the full plan and ask, "Shall we proceed?" Wait for user confirmation before running any scripts.

Reproduction: Attempt to reproduce latency and summarize findings.

Capture: Use native Windows 10 tools to capture traffic to

captures/<timestamp>_http_latency.pcapng

Scripting: Execute PowerShell scripts to isolate Client vs. Server.

Analysis: Analyze pcap locally and update the Final Report.

Operational Standards

TShark (Wireshark):

C:\Program Files\Wireshark\tshark.exe

Timestamp Format: ALL logs, tables, and filenames must use ISO 8601 (

YYYY-MM-DD HH:MM:SS

). Never use date only.

Evidence: Every "Result" in a plan must reference a specific file or log line.

scripts/simple-troubleshooting/

: Place all WMF 5.1 compatible scripts here.

Naming:
```
01_desc.ps1
```
,
```
02_desc.ps1
```
(Order matters).

docs/

: Living documentation.

Required Table Columns:
```
Timestamp
```
|
```
Host
```
|
```
Action
```
|
```
Result
```
|
```
Evidence
```
Host Definitions:
- ```
Local-Agent
```
  : The machine running the LLM/Prompt (e.g., creating plans, local analysis).
- ```
<TargetName>
```
  : The remote machine where the script executed.

captures/

: PCAP output files (Prefix with datetime).

PowerShell:

Target WMF 5.1 compatibility.
Output: Scripts must return objects (not text) containing
```
Timestamp
```
,
```
Action
```
, and
```
Result
```
.
Use
```
Write-Verbose
```
for logging.

Python:

Use
```
subprocess.run
```
instead of
```
os.system
```
.
Implement retry loops (3 attempts) for external API/Network calls.

Agentic Troubleshooting Demo

Agentic Troubleshooting Demo

Current Mission: HTTP Latency Troubleshooting

Mission Specs

Security & Authorization (CRITICAL)

Execution Plan

Operational Standards

Tools & Paths

Documentation Standards

File Architecture

Coding Guidelines

Related Skills

Markdown Converter

Nano Banana Pro

1password

Agentic Troubleshooting Demo

Current Mission: HTTP Latency Troubleshooting

Mission Specs

Security & Authorization (CRITICAL)

Execution Plan

Operational Standards

Tools & Paths

Documentation Standards

File Architecture

Coding Guidelines