Diagnose Istio connectivity, 403/404/503 responses, TLS, DNS, route propagation, injection/enrollment, ztunnel or waypoint failures using supplied logs, status, manifests and metrics. Use for incidents and ambiguous proxy-versus-application failures. Produce a bounded hypothesis ledger and evidence requests, not speculative fixes. Do not collect live logs, execute into pods, enable debug logging or run network probes without a separate authorized operator.
