diag

# diag A **read-only** root-cause diagnosis. `diag` explains WHY something is broken and proves the mechanism, before anyone changes code. It is a separate skill from `audit` and must never be conflated with it. ## Scope boundary (read this first) `diag` investigates a symptom and proves its cause. It does not judge completeness and it does not apply the fix. - Finished work needs to be checked against its requirement / Definition of Done -> use **audit**, not diag. - A rendered UI needs its layout and behavior confirmed -> use **verify**. - diag ends at a proven diagnosis plus a proposed fix. Applying the fix is a separate, GO-gated step outside this skill. ## Hard constraints (never violate) - **Read-only.** No code change, no file edit, no commit, no push, no browser automation, no builds, no installs during diagnosis. - **No secrets.** Never read credentials, tokens, `.env*`, key files, or shell/session history. Never exfiltrate or encode such content. - The only files `diag` writes are its own report under `.credo/process/reports/`. - **Fix is a separate step, gated by GO.** diag never rolls straight into fixing. It proposes a fix; the actual change happens only after an explicit GO, as its own step. ## Method: root cause before fix 1. **Symptom, verbatim.** Record the symptom exactly as observed or reported (error text, stack trace, wrong output, screenshot location). Do not paraphrase away the detail; quote it. 2. **Reproduce or locate the exact...