Investigation-report format: add abbreviated mode for routine audits

[Alan-Jowett]

Problem

The investigation-report format (formats/investigation-report.md) mandates all 9 sections unconditionally:

1. Executive Summary
2. Problem Statement
3. Investigation Scope
4. Findings
5. Root Cause Analysis
6. Remediation Plan
7. Prevention
8. Open Questions
9. Revision History

For routine, automated audits that produce few findings (e.g., <=5 findings with no Critical/High severity), several sections are pure overhead:

• §2 Problem Statement restates scope already covered in §1 Executive Summary
• §7 Prevention produces generic advice with no analytical value
• §9 Revision History produces a single-row table for one-shot analyses

Evidence

A profiling run of three PromptKit audit prompts (trifecta, code-compliance, test-compliance) against the Sonde protocol crate found:

• The test compliance audit produced 3 low-severity findings but spent ~500 response tokens (~15-25% of response) on formulaic sections (§2, §5, §7, §8, §9)
• All three audits produced mandatory §9 Revision History sections containing only | 1.0 | <date> | Initial | — approximately ~50 tokens each with zero analytical value
• The format has no conditional rules — verified by reading the format file. All sections are mandatory regardless of finding count or severity

This overhead scales across every audit type that uses the investigation-report format (trifecta, code-compliance, test-compliance, security, bug investigation, etc.).

Proposed Change

Add abbreviated format guidance to formats/investigation-report.md:

1. Add a conditional rule: If findings count is 5 or fewer and no findings are Critical or High severity, use the abbreviated format: §1 Executive Summary, §4 Findings, §6 Remediation Plan, plus a Coverage Metrics section. Omit §2, §3, §5, §7, §8, §9.

2. Independently, mark §9 Revision History as optional: Include only for documents maintained across revisions. Omit for single-pass automated audits.

Estimated Impact

~500-1,000 response token savings per low-finding audit. Applies to all templates using the investigation-report format.

Risk

Low — abbreviated format loses investigation narrative context, which is appropriate for routine audits but not incident investigations. The conditional (<=5 findings, no Critical/High) ensures the full format is used when it matters.

Source

Session profiling of three specification audits against the Sonde protocol crate (March 2026). Findings F-001, F-007, SI-2, R-003, R-007 from the profiling report.