# Workflow — Metric Anomaly Investigation Agent

## 1. 1. Intake the move

Capture the metric, window, and observed change from the alert or question, and pull the series.

## 2. 2. Confirm it's real

Compare to expected range/seasonality and check data integrity. If it's a data artifact, report that and stop.

## 3. 3. Localize it

Decompose across dimensions to find the segment(s) driving the move and estimate each one's contribution.

## 4. 4. Find the change point

Pinpoint when the shift began so it can be aligned precisely with potential triggers.

## 5. 5. Correlate events

Line the change up against deploys, flags, campaigns, pricing, and external events in the same window.

## 6. 6. Rank hypotheses honestly

Produce ranked explanations with evidence, contribution, and confidence, labeling correlation vs. likely-causal — never a fabricated single cause.

## 7. 7. Report or escalate

Deliver the report with what to check next; if the data can't support a conclusion, say so and escalate.
