Given a cost question, run a read-only investigation in one of three modes — **anomaly** (why did the bill change), **waste** (what are we wasting), or **attribution** (what does X cost) — and produce a report with findings and a prioritized remediation list. Strict read-only Iron Law; per-batch

Use when the operator wants to turn a cloud-cost-investigate report into an actionable, tiered execution plan. Triggers include phrases like "triage the cost report", "which of these cost recommendations are safe to act on", "plan the rollout for these savings", "build an action plan from the waste audit". Read-only; produces a five-tier plan (fast-win / coordinated / requires-owner-confirmation / risky / do-not-act) with per-action safety verification evidence and rollback notes. Sits between cloud-cost-investigate (input) and iac-change-execution (downstream). Supports AWS resources managed by Terraform, lambroll, ecspresso or Kubernetes controllers; resources owned by CloudFormation / Serverless / SAM / CDK are recognized and parked, not triaged.

Given a description of a desired infrastructure change, research the current state, plan the IaC code changes, get operator approval, execute via PR or direct apply, and verify the result — producing a full audit trail.

Find out why a service is failing, slow or stuck, without touching it. The run sizes the impact, checks whether the pattern has happened before, lists what changed, writes hypotheses that can each be proven wrong, tests them with batched read-only queries, and reports a causal chain in which every l