incident-response

name	incident-response
description	Handle active incidents — failing CI, production issues, runtime breakage, security alerts, agent failures. Stabilize first, diagnose second, fix third. Trigger on /incident-response, or when something is actively broken, CI is red, or emergency fixes are needed.
user-invocable	true
allowed-tools	Read, Grep, Glob, Bash, Edit

Incident Response

Handle active incidents. Different from post-mortem — this is for during the incident, not after.

Workflow

1. Stabilize

• Stop the bleeding first. Rollback if needed.
• If the incident is ongoing, can you contain it? (disable feature, block traffic, revert deploy)
• Document what you know so far — timestamp, symptom, affected scope.
• Communicate status to stakeholders if applicable.

2. Diagnose

• What changed recently? (deploy, config, dependency, infrastructure)
• Is this a recurrence of a known issue?
• Gather evidence: logs, metrics, traces, error reports.
• Form a hypothesis and test it with the smallest possible experiment.

3. Fix or mitigate

• Fix — if root cause is clear and fix is safe, apply it.
• Mitigate — if root cause is unclear, apply temporary mitigation (rollback, disable, rate limit).
• Label mitigations clearly as temporary.
• Verify the fix/mitigation resolves the symptom.

4. Document

• Timeline: when detected, when stabilized, when resolved.
• Impact: what was affected, how many users, duration.
• Root cause (if known), fix applied, follow-up items.
• Link to post-mortem after incident is fully resolved.

5. Follow-up

• Create tickets for root cause fix (if only mitigation was applied).
• Schedule post-mortem if the incident was significant.
• Update runbooks, monitoring, or alerts based on lessons learned.

Rules

• Stabilize before deep diagnosis. Stop the bleeding first.
• Do not make the incident worse — prefer rollback over forward fix in uncertainty.
• Document in real-time, not from memory after the fact.
• Distinguish between mitigation and root cause fix in all communication.

Experience Log

This skill learns from experience. Mechanism:

• Read .claude/experience/'"$s"'.md at skill start to benefit from past lessons.
• Write to .claude/experience/'"$s"'.md after use if you learned something new.
• Format: YYYY-MM-DD: <lesson> — one line per entry.
• Evolve: If the same issue repeats 3+ times, update this SKILL.md itself.