sla-incident-analyzer

name	sla-incident-analyzer
description	Calculate incident impact, detection and recovery durations, classify incidents as L0-L3 from service criticality and impact inputs, compute weighted SLA impact and derived availability, and generate post-incident Markdown reports. Use for SLA calculations, incident severity assessment, outage-duration review, availability summaries, postmortems, incident reports, and remediation tracking.

SLA Incident Analyzer

Calculate incident durations, severity, weighted SLA impact, and structured post-incident reports. Treat references/sla-standard.md as the policy implemented by the bundled script. If another policy applies, update the reference, duration_match, users_match, and SEVERITY_WEIGHTS together, then rerun the tests.

Workflow

1. Collect the service, criticality (core or non-core), availability impact (complete or partial), affected users, impact start, detection, service restoration, and business restoration times. Keep unknown fields unresolved.
2. Read references/sla-standard.md and calculate duration and severity with the bundled script. Evaluate duration and affected-user rules independently, then select the more severe result.
3. Use the final point of user-visible impact as the SLA interval end. If backlog, missing data, or incorrect results continue after service recovery, use business_restored_at; report service recovery and backlog clearance separately.
4. Classify with unrounded minutes and round only for display. Return needs_review whenever the selected policy does not cover the input.
5. Report weighted impact ratio and derived availability separately. Do not label an impact ratio as availability.
6. For a report, read references/post-incident-example.md and assets/incident-report-template.md. Separate facts, evidence, hypotheses, and unknowns. Give every action an owner, deadline, status, and verification criterion.

Commands

Classify an incident:

python3 scripts/sla_tool.py grade \
  --system "analytics-platform" --system-tier core \
  --availability partial --duration-minutes 117 --affected-users 42

Calculate impact intervals:

python3 scripts/sla_tool.py duration \
  --impact-start "2026-01-01 06:00" \
  --detected-at "2026-01-04 15:00" \
  --service-restored-at "2026-01-04 15:20" \
  --business-restored-at "2026-01-04 16:50"

Calculate per-service SLA for a period:

python3 scripts/sla_tool.py summarize --input incidents.json --output sla-summary.json

Generate a post-incident Markdown report:

python3 scripts/sla_tool.py report --input incident.json --output incident-report.md

See references/input-schema.md for the JSON schema. The default timezone is UTC; timestamps with explicit offsets retain their supplied timezone.

Delivery

• Return Markdown and JSON locally by default.
• Create or publish an external document only when the user explicitly requests that write operation; use the relevant document skill and verify the created content.
• For .docx output, use the docx skill to format the generated report.

Quality Gates

• Require explicit service criticality; never infer it from a service name.
• List missing criticality, availability type, affected users, and timestamps.
• Show duration and user-count matches separately and explain the final severity.
• If an approved severity differs from the calculated severity, retain the approved value for accounting and emit a mismatch warning.
• Calculate each service separately. Do not invent a cross-service aggregation formula.
• Warn about overlapping incidents because per-incident summation can double-count time.
• Mark unverified root causes as hypotheses.

Validate changes with:

python3 -m unittest scripts/test_sla_tool.py

References

• references/sla-standard.md: default definitions, grading matrix, severity weights, and timing semantics.
• references/post-incident-example.md: anonymized report structure and review guidance.
• references/input-schema.md: JSON input structure and example.
• assets/incident-report-template.md: report template for manual drafting or review.