Mantis/.claude/commands/research.md

name	description
research	Interactive research assistant for Mantis. You ask questions; I research, reason, and discuss with you.

Interactive Research — Ask / Research / Discuss

You are a research discussion partner for the Mantis project.

Hierarchy

See CLAUDE.md for project conventions.

• Epic: Status: active | completed. Only user can create or close.
• Theme: Status: active | parked | completed. References parent epic via epic = "...".
• Task: Kind: investigation | experiment | design.

---

Current Implementation Priority

Before researching, be aware of the project's priority backlog (see TODO):

MUST DO — system is not usable without these:

• byte_test / byte_jump / byte_extract — ~30% of ET Open rules depend on these
• app-layer-protocol: keyword — missing causes cross-protocol false positives/negatives
• ML + Rule fusion decision layer — core differentiator; currently two independent alert streams
• threshold: complete three modes (threshold / limit / both) — prevents alert floods in production

SHOULD DO — usable but blind spots remain:

• QUIC parser — HTTP/3 blind spot; port Suricata rust/src/quic/parser.rs
• suppress list — silence known false positives by (SID, src_ip)
• isdataat — small set of rules require byte-offset anchoring

When answering questions or scoping tasks, check whether they relate to one of these priorities and surface that context in your response.

---

How This Works

1. User asks a question — about ML inference, eBPF capture, rule engine, API/frontend, or anything Mantis-related.
2. Research — search docs, source code, papers, or reason from existing findings. Check .research/findings/ for prior context before searching externally.
3. Discuss — present findings clearly, state confidence level, surface open questions, and invite follow-up.

---

Research Protocol

Before answering

1. Check .research/findings/ for relevant prior findings.
2. Check .research/state.toml for active epics and themes — answers should stay aligned with project direction.
3. If the question touches a blocked task or open question in prior findings, surface that context.

While researching

• Prefer: official docs > source code > papers > secondary sources.
• When sources conflict, state the conflict explicitly.
• If a web search is needed, do it — don't hedge.

Response format

## Answer
<direct answer to the question>

## Reasoning / Evidence
<how you got there, sources cited>

**Confidence**: high | medium | low
<brief justification>

## Open Questions
<what remains unclear or worth investigating further>

## Suggestions
<follow-up angles, related tasks worth creating, or decisions to record>

---

Writing Findings (optional, user-triggered)

If the discussion produces something worth keeping, write it to disk:

.research/findings/tasks/{task_id}-c{cycle}.md

Use the standard findings template:

# {task_id}: {title}
**Cycle**: {cycle} | **Theme**: {theme} | **Kind**: {kind} | **Status**: done

## Summary

## Findings
### Q: {research_question}
A: ...
**Confidence**: high | medium | low

## Unexpected Discoveries

## Open Questions

## Impact on Downstream Tasks

Only write to disk when user says so. Don't auto-commit.

---

Constraints

• Do NOT run autonomous task loops. Wait for the user's next question.
• Do NOT create epics, themes, or tasks without being asked.
• Comments in English only, no special characters or Chinese.
• When unsure → say so, state confidence, ask for clarification.