Sleuth

Sleuth is a Codex marketplace for evidence-led investigation and structured reasoning. It contains three independently installable plugins:

• Green Ink — a six-phase public-source investigation workflow with source grading, evidence preservation, entity resolution, timelines, hypothesis testing, reporting, and optional user-hosted case persistence;
• Mind Palace — a structured-reasoning companion whose optional MCP Worker is deployed into the user's own Cloudflare account;
• PSSP — a self-hosted MCP adapter for the Pigeon Superstition Superposition behavioural-analysis framework collection.

Install

Add this repository as a Codex marketplace, then install green-ink, mind-palace, or pssp independently. The marketplace file is .agents/plugins/marketplace.json and every entry resolves directly beneath plugins/.

Starter selectors:

• $green-ink:over-c
• $mind-palace:take-a-moment
• $pssp:pigeon-superstition-superposition

PSSP and Mind Palace MCP deployment

PSSP and Mind Palace bundle deployable Cloudflare Worker source under each plugin's mcp/ directory. The plugin package does not include a static .mcp.json because the final Worker URL is unique to the user's Cloudflare deployment.

For PSSP:

cd plugins/pssp/mcp
npm install
npx wrangler login
npm run deploy
codex mcp add pssp --url https://<your-worker>.workers.dev/mcp

For Mind Palace:

cd plugins/mind-palace/mcp
npm install
npx wrangler login
npm run deploy
codex mcp add mind-palace --url https://<your-worker>.workers.dev/mcp

Replace each example hostname with the URL Wrangler reports. Installing either plugin alone does not deploy external infrastructure.

Green Ink persistence

Green Ink does not use a povvo-hosted service. Its optional MCP/D1 persistence layer is deployed into the user's own Cloudflare account and fails closed without bearer authentication.

1. Install and authenticate Cloudflare Wrangler explicitly.
2. Run python plugins/green-ink/mcp/setup.py --dry-run to check prerequisites.
3. Run python plugins/green-ink/mcp/setup.py to create or locate D1, deploy the Worker, and store a strong bearer token as a Wrangler secret.
4. Copy the shape in plugins/green-ink/mcp/mcp.json into local Codex MCP configuration using the user's endpoint and token.

No installation or SessionStart hook downloads tools, deploys services, or creates external state.

Public-archive OSINT

Public Wayback and archival search, retrieval, comparison, and capture are normal Green Ink OSINT operations and remain available by default. evidence_preservation.py captures and hashes evidence, creates local custody records, and submits a public URL to Wayback when the optional dependency is installed. Use --no-wayback when a particular capture should remain local-only.

Local case state and custody

Initialise each Green Ink investigation in a user-owned project workspace:

python plugins/green-ink/skills/over-c/scripts/task_runner.py init <investigation-id> --workspace /path/to/project

Progress and the Investigation Notebook are isolated under .green-ink/cases/<investigation-id>/ in that workspace. The runner refuses to place mutable case state inside the installed plugin tree. Green Ink's case export refuses symlinks and Windows reparse points, proves path containment, and does not overwrite an existing export. API secrets are redacted from cache keys, logs, reports, and errors.

Everything below plugins/pssp/skills/ remains the original release methodology. Wrapper and repository metadata do not change its psychology content.

Licence

Sleuth is source-available under LicenseRef-povvo-Source-Available-1.0. Unmodified official releases may be inspected, installed, and run. Modification and redistribution require separate permission; see LICENSE.

Support the work

If Sleuth is useful to you, support continued development through Buy Me a Coffee.