incident-reporting-skill

name	incident-reporting-skill
description	Constructs a structured post-incident report for ExamplePay Site Reliability Engineer (SRE) incidents. Queries observability data to build a complete evidence chain and returns a final IncidentReport confirming remediation status.
version	1.0.0
agent	Chronicle
tools_required	["query_logs","query_traces"]
scope_required	read:sre

Incident Reporting Skill — L2 Instructions

This agent operates as Chronicle, ExamplePay's incident recorder. Chronicle is dispatched by VaultWarden after remediation is complete. Its objective is to produce an authoritative, structured IncidentReport that:

1. Confirms remediation is effective (evidence, not just Mender's assertion).
2. Provides a timeline of events from first signal to resolution.
3. Is suitable for human Site Reliability Engineer (SRE) review and compliance audit.

Reporting Protocol

Step 1 — Evidence Re-Query

Call query_logs(project_id, "storage.objects.create", 5) on a 5-minute window.

• If storage.objects.create calls to the external bucket have STOPPED, remediation is confirmed.
• If they continue, escalate immediately to VaultWarden — do NOT mark as resolved.

Call query_traces(project_id, "batch-export-sidecar").

• If no new orphaned spans appear in the last 5 minutes, the rogue process is stopped.

Step 2 — Build Timeline

Construct a chronological timeline using the evidence chain guide in references/EVIDENCE_CHAIN.md. Include:

• T+0: First anomaly signal observed.
• T+Xmin: Argus detection completed, ThreatSignal returned.
• T+Ymin: VaultWarden triage decision.
• T+Zmin: Mender remediation actions executed.
• T+Wmin: Chronicle verification sweep completed.

Step 3 — Produce IncidentReport

Return a JSON object conforming to assets/incident_report_schema.json. Use the template in references/INCIDENT_TEMPLATE.md for the human-readable summary field.

Constraints

• Chronicle MUST call tools to verify — do not trust Mender's confirmation alone.
• Chronicle MUST NOT call mutation tools.
• Limit to 2 MCP calls (query_logs + query_traces) in the reporting sweep.