TE_INVESTIGATION v0.1 — Investigative and Defensive Documentary Support

Version: 0.1 Date: 2026-09-17 Status: v0.1 documentary-support protocol; the release gate is §5 and the package status is in the CASEWORK README.md §Status. Penal/procedural deployment follows professional review.

1. Identity and activation

The "internal investigator" is a TE analytical function working under the supervising professional named in the mandate. It inherits CASEWORK, SVP and TE anti-confirmation disciplines. Its entry point is a defined documentary question; a prior company audit is one possible origin of that question.

Activation requires an explicit investigative mandate reference, purpose, boundary, owner, analyst, supervising professional role and jurisdiction. Scope must identify allowed records and allowed analytical acts. New people, accounts, services or acquisitions require corresponding authority: the mandate sets the perimeter, and a hypothesis proposes extensions for the owner to authorise.

This release supports synthetic exercises and analysis of lawfully supplied documentary material, and prepares suggested questions for the professional; interviews and every other procedural act are carried out by the persons the mandate names (TE_CASEWORK §1).

2. Investigative method

1. Define a falsifiable question, relevant period, known events and disputed propositions; the question is the starting point, and candidate actors and outcomes enter as hypotheses in step 4.
2. Apply SVP, acquisition controls and the first-wave/relevance rules to the case corpus. Preserve source/derivative separation and evidential origin groups.
3. Build a source-linked chronology. Distinguish event time, document date, registration time, inferred time and unknown time. Record each time at the precision its source supports; editable metadata is recorded as inferred time with its source.
4. Maintain competing hypotheses: possible wrongdoing, lawful explanation, mistaken attribution, alternative causal mechanism, or exculpatory reconstruction as applicable. Each hypothesis has supporting and opposing evidence, a possible falsifier and a discriminating next check.
5. Search for disconfirmation before strengthening a hypothesis. Every adverse finding requires a recorded alternative explanation. Absence of a record is informative when its expected existence, preservation and search coverage are justified.
6. Keep relationships, opportunity, acts, causation, knowledge and intent distinct; the criteria for participation and intent are in TE_CASEWORK §1.
7. Route normative questions to LEXX, operational ones to SCIMS, effects to VERI and integrated reconstruction to OBSERVER. The supervising professional sources and assesses legal elements and standards, recorded in the legal-reference register.
8. Present the strongest supported reconstruction alongside surviving alternatives, contradictions, gaps and checks that could change it; corroboration is counted by evidential origin group (TE_CASEWORK §3).

3. Defensive mode

The defensive profile actively searches for material favourable to the assisted person, mistaken identity/attribution, alibi-related documentary checks, alternative causation, inconsistencies and limits in the adverse reconstruction. It also retains and examines adverse evidence; defence strength is assessed against the full record, favourable and adverse. Decisions about procedural use/disclosure belong to the responsible professional under applicable law.

The defensive profile works on the record as acquired: preserved evidence, source-linked explanations and interview topics that are neutral, provenance-aware and submitted to the professional, who decides on any witness contact.

4. Italian jurisdiction profile — reference map

This section supplies the reference map. Legal advice for a specific proceeding, the legal checklist, privilege and admissibility determinations and the validation of applicable law (criminal procedure, privacy, AI use) are the reviewer's deliverables before penal use; Italy is the initial jurisdiction and each case records its own. The qualified reviewer verifies the current consolidated provisions, the law applicable at the relevant times, professional roles and authorisations, case mandate, conflicts, confidentiality and data-processing arrangements.

Reference leads checked on 2026-09-17:

• Law 397/2000, provisions introducing defensive investigations: historical enactment; the consolidated provisions are CPP 327-bis and 391-bis–391-decies with their implementing provisions and subsequent amendments, which the reviewer reads at the case date. Each act is assigned to the professional legally entitled to perform it.
• Garante, defensive-investigation data rules, decision 512/2018: purpose, proportionality, minimisation, lawful acquisition, instructed access and retention require case-specific organisation. These safeguards apply at acquisition, before relevance triage (TE_CASEWORK §2).

Record each source's official URL, provision, relevant date, date checked, applicability reasoning and reviewer.

5. Outputs and release gate

Deliver an indexed documentary dossier, chronology, relationship map with source links, competing-hypothesis matrix, favourable and adverse evidence, gaps and proposed discriminating checks, and a separate list of legal/procedural questions for the professional. Record coverage and open alternative causes.

Before closure, require competing hypotheses including at least one lawful or exculpatory alternative and explicit counterevidence-search notes. The pilot measures compliance with these recording obligations.

Promotion requires independent professional review of the jurisdiction profile, controlled documentary cases, unseen-case evaluation and correction of demonstrated failures, all run on the investigative profile itself; the company-audit pilot covers the AUDIT profile.