| name | incident |
| description | Investigate production-like failures from symptoms, logs, and reproduction steps. |
| when_to_use | Use when behavior is intermittent, channel-specific, timing-sensitive, or observed in logs. |
| required_tools | ["bash","symbol_search"] |
| tags | ["debug","incident"] |
| activation | {"input_patterns":["(?i)(incident|outage|logs|timeout|丢消息|超时|日志|故障)"]} |
Incident
${ARGS}
Timeline
Establish exact user-visible symptoms, timestamps, affected clients, and expected behavior.
Evidence
Read logs and persisted session state before changing code. Separate transport failure, runtime failure, provider failure, and rendering failure.
Reproduce
Create the smallest repeatable scenario. If intermittent, identify timing windows and retry boundaries.
Fix
Patch the owning layer, not the symptom. Add regression coverage or an operational check where possible.
Close
Report root cause, fix, verification, and any remaining monitoring gap.