During an investigation

Nova works on its own and waits for you only when nothing else is left to read. You can step in at any point, from the console, the API, the terminal, or on Enterprise the investigation's Slack thread.

Read the card

The card reads top to bottom:

1. Status and how long it has been running. Once triage has sized it, the status line also shows the size and price, such as Standard investigation: 5 units (1 if Nova can't read anything).
2. Headline: what Nova is doing, or the cause once it has one.
3. One supporting line: the quote the answer rests on, or, until there is one, What we know, the main things Nova has observed so far.
4. Plan: each step, done, active or waiting. A step waiting on a slow read says what it waits for.
5. Needs you: each question waiting for a person, with its deadline: a read to allow, a change to approve, or Nova's own question. At most one of each kind is open at a time, and each is answered on its own.
6. Fix: while you decide it, and how it ended once it has.
7. The next step and the actions that apply now, such as Acknowledge, Steer and Stop.

The side panel holds the full record: every read, the evidence quoted with source and time, what Nova could not check, the causes ruled out, past incidents on the app, and the postmortem. Open it with Open the full record on the card. For every status and what it means, see the investigation card reference.

In the terminal, type /investigations in astroctl nova and press Enter on an investigation to open the same card. It updates as the investigation moves. Press a on the card to answer it, p to print it into the conversation, and Esc to go back to the list.

Allow or decline a read

Some reads need a person's approval. By default that is app logs and security scan results, and any call to one of your own MCP servers that no admin has trusted. When Nova reaches for one, the card asks under Needs you, for example "Allow Nova to read App Logs for checkout?", with the detail: Read only, for checkout. Allow once covers one read; Allow for this chat covers the same app, tool, connection and schema until the access grant expires. Nova keeps checking what it can meanwhile.

Answer	What it does
Allow once	Allows one read.
Allow for this chat	Allows the same app, tool, connection and schema for the rest of this chat, until the access grant expires (60 minutes by default). Not offered when the connection requires single-use approval.
Decline	Nova carries on without it. The read is listed under Could not check, and a cause that needed it stays Likely.

Where to answer:

• Console: the buttons in the Needs you box.
• Terminal: press a on the investigation's card in /investigations, or Ctrl+A on an empty prompt while you follow it. Select Allow once, Allow for this chat or Decline with the arrow keys, press Enter to review it and Enter again to send it.
• Slack: the card's buttons in the investigation's thread, for people who may approve reads.

No answer by the deadline counts as Decline. A declined read is not asked about again in that investigation.

What a sensitive read returned is shown only to people who may approve reads and to whoever allowed it. Everyone else sees Sensitive read: visible to people who can allow reads in its place, including in the postmortem.

Nova investigates and asks before reading logs

Answer Nova's question

When the leading cause has not moved for two steps, Nova may ask one focused question with suggested answers, about the thing that would move it forward.

• Pick a suggested answer, or Answer in your own words.
• In the terminal: open the investigation's answers (a on its card, or Ctrl+A), select a suggested answer, then press Enter twice. When you choose Answer in your own words, the prompt takes them: type them and press Enter, or Esc to cancel without sending.
• In the investigation's Slack thread: a button, or a reply in the thread.

Your answer is weighed like a read. On its own it can make a cause Likely, never Cause found.

When Nova has found a cause but could not check something about it, it may ask you to confirm that, for example "Can you confirm …?", with Yes, it's fine, No or Don't know. Yes keeps the cause found, No investigates again with the rival cause open, and Don't know leaves it listed as not checked.

Steer it

Tell Nova what to check first while it is investigating.

• In the console, choose Steer on the card and write it, for example "check the database first".
• In the terminal: open the investigation's answers, choose Steer, then type it in the prompt and press Enter.
• In the investigation's Slack thread, choose Steer and type it in the box that opens.

Steering changes the order of Nova's reads. It never grants access to anything. Steer is offered only while Nova is investigating, and it needs your words. Once Nova is applying a fix, Stop is still offered and Steer is not.

Acknowledge

Let the team know you have seen it: Acknowledge on the card or in the investigation's Slack thread, or Acknowledge in the investigation's answers in the terminal. The card shows who acknowledged. Taking the fix over is a separate step.

Ask follow-up questions

Keep asking in the same conversation, for example "why did you rule out the database?", "what changed in the last deploy?" or "summarise this for the incident channel". Nova answers from the investigation's record: the cause and whether it is found or likely, the evidence, the causes ruled out, the reads it made, what it could not check, and who decided what.

When a follow-up needs something new, Nova reads it under the same guardrails:

• A read you allowed during the investigation is allowed again in this conversation, for the same app, until your organization's access window ends (60 minutes by default) or its allowed uses run out.
• Any other app, or a read after the window, is asked about again.
• A change goes through your guardrails, which require approval for changes by default.

In the investigation's Slack thread, Why? Show the evidence on Nova's conclusion shows you the cause and the evidence from the record, only to you; a read Nova has not made is asked for in the console.

To pick the investigation up elsewhere: open Investigations in the console sidebar, open it from /investigations in the terminal, run astroctl nova --continue to continue your most recent conversation, or read the same card from Nova's API.

Stop it

Stop is available while Nova is investigating or applying a fix. Nothing further starts and Nova makes no further change.

• Console: Stop on the card.
• Terminal: Stop in the investigation's answers, then Enter twice.

Close or reopen it

End an investigation yourself with Mark resolved (optionally saying what fixed it) or Close, with a reason: Not an incident / false alarm, Won't fix, Duplicate of another incident or Handled outside Nova. Reopen takes it back up. Both are recorded with who did it and when.

Every path, the same answers

Task	Console	Terminal	Alert's Slack thread
Find	Investigations in the sidebar	/investigations	The alert's message
Follow	The card, live	Enter on it in /investigations, or the card in the chat	The message updates in place
Allow or decline a read	Allow once, Allow for this chat, Decline	a or Ctrl+A, select the answer, Enter twice	The card's buttons (approvers only)
Answer or steer	On the card	a or Ctrl+A, then Enter twice; words in the prompt	Button; an answer to Nova's question can also be a reply in the thread
Stop	Stop	Stop in the answers, Enter twice	Not in Slack: use the card's link
Full record	The side panel	The card in /investigations	Link to the card

One answer wins wherever it is given: if someone answered first, or the question expired, you are told so and nothing runs. Nova's API does the same: Over the API.

Next

• Fixes and mitigations: approving a change.