القائمة
Incident investigation protocol — structured debugging with 5-why analysis, evidence gathering, and post-mortem documentation.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Demo pipeline state machine — 7-phase autonomous sequence with delegation context templates, phase transition logic, BLOCKED recovery strategies, and demo-state.json schema. Used exclusively by demo-conductor.
Cinematic narration style guide for demo-conductor — ANSI-coloured banner formats, live pipeline scoreboard, audience-facing language, phase summaries, and error narration patterns. Keeps the demo presentation-quality throughout.
Standardized completion and escalation protocol for subagent responses. Ensures the conductor can machine-parse every subagent return. Use when reporting completion status back to the orchestrator.
Cross-session learnings lifecycle — schema, storage, retrieval, and pruning of lessons learned during orchestrator sessions. Use when managing learnings via the /learn command.
Agent Teams assembly and task injection — selects appropriate team, validates prerequisites, estimates cost, injects tasks into the shared task list, and manages team lifecycle.
Token and cost tracking with model tier enforcement
| name | incident-response |
| description | Incident investigation protocol — structured debugging with 5-why analysis, evidence gathering, and post-mortem documentation. |
| user-invocable | false |
| Level | Impact | Response Time | Escalation |
|---|---|---|---|
| SEV1 | Service down, data loss | Immediate | Architect + Security |
| SEV2 | Major feature broken | < 1 hour | Lead + Reviewer |
| SEV3 | Minor feature degraded | < 4 hours | Implementer |
| SEV4 | Cosmetic, non-blocking | Next sprint | Doc in backlog |
Why did the service fail? → {direct cause}
Why did that happen? → {contributing factor}
Why wasn't it caught? → {detection gap}
Why wasn't it prevented? → {process gap}
What systemic change prevents this? → {root cause fix}
## Incident: {title}
**Date:** {date}
**Severity:** {level}
**Duration:** {start} → {end}
**Impact:** {who/what affected}
### Timeline
- {HH:MM} — {event}
### Root Cause
{5-why chain}
### Resolution
{what was done}
### Action Items
- [ ] {preventive action} — Owner: {name} — Due: {date}
If 3 fix attempts fail → stop and escalate to architecture review. Don't keep trying random fixes.