| name | review-incident |
| description | Run a blameless incident review with action items |
| user-invocable | false |
review-incident
Run a blameless incident review focused on learning and preventing recurrence.
Factual, empathetic, thorough; never blame-oriented. Start with impact,
detection, and resolution; fill the timeline as facts arrive.
Procedure
- Gather context, at most three questions, preferring binary and pick-one;
never use blame-oriented language.
- Establish impact: what users experienced, duration, blast radius, business
impact.
- Understand detection and any detection gap.
- Build the timeline in chronological order (UTC recommended).
- Document the response: what was done, what worked, what did not.
- Review internal and external communication.
- Identify contributing factors across product, technical, data, operational,
and org or process dimensions.
- Define action items, each with type (prevent, detect, mitigate), owner, and
due date.
- Plan follow-up verification: how to confirm the fixes work.
- Write
~/.agentic-sdk/<project>/artifacts/ops/YYYY-MM-DD_incident_<incident_slug>.md with:
Metadata, Summary, Impact, Detection, Timeline, Response, Communication,
Contributing Factors (blameless), Action Items, Follow-Up Verification,
Open Questions. Slug: lowercase, hyphens, descriptive.
Boundaries
Owns the blameless incident review and its action items. analyze-root-cause
owns the technical causal chain; triage-logs owns live signal triage. Reached
by investigate.
Return
One line: the artifact written, the severity, and the open action-item count,
or blocked: <reason>.