Choose a capability

Start with the failing behavior and inspect evidence that already exists. People and automation use the same routing catalog:

tricky capabilities
tricky capabilities -Json

Capability discovery is observational. It lists commands but never starts capture, launches a debugger, changes policy, or repairs desired state.

Diagnose a failure

Route	Use when	Inspect first	Explicit next action
memory-pressure	RAM, commit, WSL memory, a kernel pool, or an early-OOM intervention	mem, memapps, memproc, Get-WorkloadMemoryDiagnostics.ps1 -Action Events	profile-native-record CASE -Seconds 30
network-path	DNS, IPv6, firewall, port, or reachability fails	ports, connections, existing PCAPNG	pcap-debug-start CASE
http-authentication	An HTTP operation fails, including Office Store installation	http-debug-summary -Path EXISTING.etl -Executable WINWORD.EXE	Review http-debug-start -Name CASE -Executable WINWORD.EXE -Plan before capture
crash-analysis	A process exits, faults, freezes, or hangs	crashes, problems, existing dumps	dump-on-crash -Name CASE -Executable PATH
windbg-mcp	A Windows host agent should read a live WinDbg session or a loaded dump	windbg-mcp Status, windbg-mcp Sessions -Json	dump-open DUMP in the MCP session, then tricky debug CASE -DebuggerCommand .lastevent,k,lm
native-performance	Native or system-wide CPU and latency matter	profile-status, existing ETL	profile-native-record CASE -Seconds 30
python-performance	A Python process consumes CPU	profile-view PROFILE.svg	profile-python -ProcessId PID -Seconds 30 -Output PROFILE.svg
dotnet-performance	A .NET process needs EventPipe evidence	profile-dotnet-ps, existing Speedscope output	profile-dotnet -ProcessId PID -Seconds 30 -OutputBase CASE
event-history	Service, login, audit, or general Windows history may explain a failure	problems, service-errors, loginfail	eventlog-start CASE -Executable PATH
security-state	Defender, firewall, SmartScreen, or SaveZone may be involved	firewall-status, defender-status, smartscreen-status, savezone-status	Export and add the state to a Tricky case
malware-triage	A file is suspicious, general Sandbox behavior must be compared, or two binaries need structural comparison	is-this-malware PATH, sandbox-behavior-control PATH, or binary-diff OLD NEW	Use a separately confirmed Sandbox launch or rootless graph-parser run only after reviewing its plan
autopsy-forensic-analysis	Existing evidence needs interactive Autopsy or matching native Sleuth Kit inspection	.\Apply-Workstation.ps1 -Mode Test -Module Autopsy -Plan	Explicitly apply the opt-in Autopsy module only after reviewing its Defender and tool-write boundaries
forensic-evidence-verification	An existing segmented EWF image needs an attributable stored-digest and segment-integrity check	ewf-verify PATH.E01 -ReportDirectory REPORTS -Plan	Run ewf-verify without -Plan only after reviewing the native tool state and separate report destination

Commands in the next-action column start a capture or cross an execution boundary. Review the target and scope before running one. The focused workflow pages under Diagnose and Secure explain each boundary.

Follow the concrete operator evidence and safety boundaries in sample outputs, hardening residual attack surface, debloat rollback limits, and malware-analysis isolation, and graph-first analysis differencing, and read-only EWF verification.

Inspect or configure the workstation

Route	Use when	Safe first command
razer-rgb	Inspect optional keyboard lighting with the mouse on Bluetooth	pwsh -NoProfile -File .\scripts\Set-RazerRgbState.ps1 -Mode Test
powershell-environment	Bootstrap PowerShell 7, profiles, or Windows Terminal	powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Apply-Workstation.ps1 -Mode Test -Module PowerShell7 -Plan
powershell-testing	Discover Pester tests, parallel execution, or 5.1 compatibility	test-powershell
repository-quality	Check PowerShell, Python, Dockerfiles, Actions, YAML, JSON, TOML, and staged-file safety	lint-repository or precommit-run
workstation-help	Find managed commands, aliases, and skills	workstation-help
idle-sleep-inhibition	Inspect Caffeine and its startup state	pwsh -NoProfile -File .\scripts\Set-CaffeineState.ps1 -Mode Test
workstation-modules	Select desired state, inspect managed packages such as pnpm or Audio Switcher, or review the complete update workflow	.\Apply-Workstation.ps1 -Mode Test -Module Packages -Plan, pnpm --version, pwsh -NoProfile -File .\scripts\Set-AudioSwitcherState.ps1 -Mode Test, or update
linux-developer-packages	Inspect Homebrew, pyinfra, Dagger, or container engines in WSL	pwsh -NoProfile -File .\scripts\Set-LinuxHomebrewState.ps1 -Mode Test
go-development	Inspect Go, its workspace, and toolchain selection	go version
package-supply-chain	Inspect Safe-Chain protection for pnpm and other supported npm/Python package managers on Windows and trusted Debian	pwsh -NoProfile -File .\scripts\Set-SafeChainState.ps1 -Mode Test, Get-Command pnpm,pnpx -CommandType Function | Format-List Name,Definition, pnpm safe-chain-verify, or pnpx safe-chain-verify
native-development	Inspect MSVC, CMake, Rust, Java, and explicitly activate MSVC	msvc-activate; Get-Command cl.exe,link.exe,msbuild.exe
spec-driven-development	Check EARS requirements, tasks, tests, and final traceability	ears-sdd status --phase final
terminal-fonts	Inspect the selected terminal font and pinned Fira Code fallback	pwsh -NoProfile -File .\scripts\Set-TerminalFontState.ps1 -Mode Test
native-text-tools	Inspect native awk and sed for PowerShell	pwsh -NoProfile -File .\scripts\Set-NativeTextToolsState.ps1 -Mode Test
contour-terminal	Inspect the official MSI, BlueTerm configuration, and graphics gate	pwsh -NoProfile -File .\scripts\Set-ContourTerminalState.ps1 -Mode Test
windows-hardening	Compare the developer hardening baseline and residual exposure	powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\Set-HardeningState.ps1 -Mode Plan
windows-exploit-protection	Compare DEP, ASLR, CFG, SEHOP, heap, and related process mitigations	powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\Set-ExploitProtectionState.ps1 -Mode Plan
windows-debloat	Review opt-in application and legacy-component removal	powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\Set-DebloatState.ps1 -Mode Plan
windows-virtualization	Inspect Hyper-V and Windows Sandbox dependency order	powershell -NoProfile -File .\scripts\Set-WindowsFeatureState.ps1 -Mode Plan
desktop-focus	Inspect the click-to-focus default and explicit hover-focus toggles	pwsh -NoProfile -File .\scripts\Set-FocusFollowsMouseState.ps1 -Mode Test
quant-research-environment	Inspect Positron, Quarto/Pandoc/private TinyTeX, the OpenBB base, PyXLL, independently locked uv overlays, notebooks, or deferred Source relocation	Set-QuartoState.ps1 -Mode Test, quant-status, or source-relocation-plan -Target D:\Source
ai-tools-isolation	Inspect native AI tools, OpenCode extensions, the developer editor, AI NixOS, and all WSL trust roles	pwsh -NoProfile -File .\scripts\Set-OpenCodeExtensionsState.ps1 -Mode Test, pwsh -NoProfile -File .\scripts\Set-AiToolsState.ps1 -Mode Test, or pwsh -NoProfile -File .\scripts\Test-WslTrustBoundary.ps1

Routing contract

config/capabilities.psd1 is the authority for route names, triggers, evidence kinds, and commands. Human output is the default. Use tricky capabilities -Json for machine consumption. When a command changes, update the catalog and this decision page together.