name: incident-response
description: Full incident-response pipeline — declare → stabilize → investigate in parallel → root-cause → permanent fix → resolve → postmortem. Use when production is broken, degraded, or under attack. Triggers on: incident, down, outage, prod is broken, sev1, sev2.
Incident Response Skill
This skill runs the Incident Response Pipeline as defined in AGENTS.md.
When to use
Load this skill when the user reports any of:
- "Incident", "down", "outage", "prod is broken"
- A live customer-facing failure
- A surge of errors / latency in production
- A suspected breach or abuse
- Any "this is on fire" signal
Do not use this skill for:
- Bug reports in dev / test → use the Debug Agent directly
- Known reproducible bugs → run the Change Pipeline
- Performance regressions caught in CI → run the Performance Agent
Workflow
Follow the canonical 7-phase pipeline:
- Declare — spawn Incident Commander → severity → open
docs/incidents/{YYYY-MM-DD-HHMM}_{slug}.md → initial comms.
- Stabilize — rollback / flag-off / failover / shed / restart, in that priority order. Telemetry must confirm recovery.
- Investigate (parallel) — Debug, Performance, Security, Database, SQL Query, Observability — spawned in parallel based on symptom.
- Root cause — first hypothesis confirmed by evidence wins.
- Permanent fix — run Change Pipeline from step 2 onward (the incident doc is the spec).
- Resolution — only when telemetry is stable for the SEV's observation window (SEV1: 30 min, SEV2: 1 h, SEV3: 4 h).
- Postmortem — Retrospective writes a blameless postmortem; Doc Updater updates runbooks; action items go to the next session's todo.
Severity matrix
| Severity | Definition | Update cadence | Observation window |
|---|
| SEV1 | Customer-facing outage, data loss, revenue impact | 15 min | 30 min |
| SEV2 | Major degradation, partial outage, critical path slow | 30 min | 1 h |
| SEV3 | Minor degradation, single-tenant, cosmetic | 1 h | 4 h |
Librarian-first under pressure
Even in a SEV1, query the Librarian first — but in fast mode: cached briefs are acceptable, index refresh is deferred to post-incident. Do NOT skip the Librarian — investigators need an up-to-date code/infrastructure brief, not raw source.
Consistency Check
A single gate runs after Phase 7 (postmortem). This is a deliberate SEV1 speed exception to the standard 3-gate pattern; mitigation correctness is verified by telemetry in real time, not by a static gate. SEV2 / SEV3 may opt into 3 gates at the Commander's discretion.
See also
