code-blue

name	code-blue
description	Production incident response. Use when something is on fire — outage, data corruption in progress, severe regression, urgent customer-blocking failure. Activates the CGH Code Blue protocol — assigned roles, structured loop, 2-minute pulse checks. NOT for routine bugs (use /triage first).

Code Blue

Overhead page: "Code Blue, [location]. Code Blue, [location]."

A patient is coding. In our world: production is down, or going down fast. Drop everything. We follow ACLS — Advanced Cardiac Life Support — adapted for software.

The full clinical protocol lives at protocols/code-blue.md. This skill runs it.

---

Roles (assign before doing anything else)

Role	Who	What they do
Code leader	The most senior person present	Calls the shots. Does not do the chest compressions. Watches the whole room.
Compressor	Whoever's hands-on	Doing the actual work — pushing the rollback, killing the bad pod, draining the queue.
Recorder	Anyone with a keyboard free	Timestamps everything: what was tried, what happened, who was paged. This becomes the M&M.
Runner	Floats	Pages people. Updates status page. Talks to the comms / customer-facing person.
Pharmacy	/consult-pharmacy if relevant	If the cause is a recent dependency change.

Even if it's just you and Claude: say the roles out loud in the first message. "I am the leader and the recorder; Claude is the compressor."

---

The loop (every 2 minutes)

1. Pulse check. Is the metric (error rate, p95, queue depth, etc.) recovering, flat, or worsening?
2. Rhythm check. What does the data show right now? Don't act on what you saw 5 minutes ago.
3. Intervention. One change. ONE. (Rollback, restart, scale, feature-flag off, route around.)
4. Document. Recorder logs the timestamp, intervention, and outcome.
5. Repeat.

If the patient hasn't returned to baseline after 3 cycles, escalate: page senior, consider broader rollback, consider declaring Code Yellow (mass-casualty / many users affected).

---

Reversible-first rule

In a code, you reach for reversible interventions first:

1. Feature flag off (instant, reversible).
2. Rollback to last-known-good (fast, reversible).
3. Scale up / restart (medium, mostly reversible).
4. Hotfix forward (slow, not reversible — last resort during the code itself).

Do not reach past a level you haven't tried unless you have a specific reason. "It's probably the database" is not a specific reason. Evidence is.

---

When to call it

You can return of spontaneous circulation (ROSC) when:

• Primary metric is back to baseline AND
• It's been stable for at least one full check cycle AND
• You've identified the proximate cause (or have a working hypothesis).

You can call time of death (declare extended outage, notify externally, escalate to leadership) when 3 cycles of escalating intervention haven't restored function. Get Holloway (CMO) and Petrov (Chief of Surgery, who runs incident command for severity-1) on the line.

---

After ROSC

1. Stabilize. Don't immediately leave. Watch for re-arrest for at least 30 min.
2. Hand off to the on-call with full SBAR. See /rounds and workflows/handoff-sbar.md.
3. Schedule M&M within 72 hours. Page /m-and-m.
4. Save the recorder's log. It goes verbatim into incident-log/.

---

What Code Blue is NOT

• It is not a place for hot takes. ("I bet it's DNS.") Save them for M&M.
• It is not a place for git push --force to main. If you're tempted, you're wrong, and Holloway will find out.
• It is not for non-urgent bugs. If you're not sure, run /triage first. Calling Code Blue for a Level 3 issue burns trust the next time it's real.

---

Stay calm. Hands on the chest, eyes on the monitor, voice on the team. Run the loop.