| name | code-blue |
| description | Production incident response. Use when something is on fire — outage, data corruption in progress, severe regression, urgent customer-blocking failure. Activates the CGH Code Blue protocol — assigned roles, structured loop, 2-minute pulse checks. NOT for routine bugs (use /triage first). |
Code Blue
Overhead page: "Code Blue, [location]. Code Blue, [location]."
A patient is coding. In our world: production is down, or going down fast. Drop everything. We follow ACLS — Advanced Cardiac Life Support — adapted for software.
The full clinical protocol lives at protocols/code-blue.md. This skill runs it.
Roles (assign before doing anything else)
| Role | Who | What they do |
|---|
| Code leader | The most senior person present | Calls the shots. Does not do the chest compressions. Watches the whole room. |
| Compressor | Whoever's hands-on | Doing the actual work — pushing the rollback, killing the bad pod, draining the queue. |
| Recorder | Anyone with a keyboard free | Timestamps everything: what was tried, what happened, who was paged. This becomes the M&M. |
| Runner | Floats | Pages people. Updates status page. Talks to the comms / customer-facing person. |
| Pharmacy | /consult-pharmacy if relevant | If the cause is a recent dependency change. |
Even if it's just you and Claude: say the roles out loud in the first message. "I am the leader and the recorder; Claude is the compressor."
The loop (every 2 minutes)
- Pulse check. Is the metric (error rate, p95, queue depth, etc.) recovering, flat, or worsening?
- Rhythm check. What does the data show right now? Don't act on what you saw 5 minutes ago.
- Intervention. One change. ONE. (Rollback, restart, scale, feature-flag off, route around.)
- Document. Recorder logs the timestamp, intervention, and outcome.
- Repeat.
If the patient hasn't returned to baseline after 3 cycles, escalate: page senior, consider broader rollback, consider declaring Code Yellow (mass-casualty / many users affected).
Reversible-first rule
In a code, you reach for reversible interventions first:
- Feature flag off (instant, reversible).
- Rollback to last-known-good (fast, reversible).
- Scale up / restart (medium, mostly reversible).
- Hotfix forward (slow, not reversible — last resort during the code itself).
Do not reach past a level you haven't tried unless you have a specific reason. "It's probably the database" is not a specific reason. Evidence is.
When to call it
You can return of spontaneous circulation (ROSC) when:
- Primary metric is back to baseline AND
- It's been stable for at least one full check cycle AND
- You've identified the proximate cause (or have a working hypothesis).
You can call time of death (declare extended outage, notify externally, escalate to leadership) when 3 cycles of escalating intervention haven't restored function. Get Holloway (CMO) and Petrov (Chief of Surgery, who runs incident command for severity-1) on the line.
After ROSC
- Stabilize. Don't immediately leave. Watch for re-arrest for at least 30 min.
- Hand off to the on-call with full SBAR. See
/rounds and workflows/handoff-sbar.md.
- Schedule M&M within 72 hours. Page
/m-and-m.
- Save the recorder's log. It goes verbatim into
incident-log/.
What Code Blue is NOT
- It is not a place for hot takes. ("I bet it's DNS.") Save them for M&M.
- It is not a place for
git push --force to main. If you're tempted, you're wrong, and Holloway will find out.
- It is not for non-urgent bugs. If you're not sure, run
/triage first. Calling Code Blue for a Level 3 issue burns trust the next time it's real.
Stay calm. Hands on the chest, eyes on the monitor, voice on the team. Run the loop.
