incident

Files (1)

• SKILL.md

SKILL.md (first lines)

# /sdlc:incident — first responder that writes the next intent.md

Read `sdlc-loop` and `sdlc/lessons.md` (repeat incidents are the norm; check first).

## Diagnose (read-only)

- Tools: Read, Grep, `git log`, CI run logs (`gh run view`, GitLab MCP), Sentry MCP (issues, events, stack
  traces), Grafana/Prometheus MCP (query the metric around the breach), tracker MCP (the ticket), RingCentral
  MCP (the incident thread). No edits, no deploys, no production access.
- Establish: what breached (metric, band, rule, window), when, what changed in that window (deploys, merges,
  config, dependency bumps), the most likely cause with confidence, what was ruled out.
- If `--evidence <file>` is given (the detection script's JSON), start from it.

## Act only through gated routes

| Tier | You may |
|---|---|
| 2σ (diagnose) | write the incident intent and comment on the ticket/thread. Nothing else. |
| 3σ (propose) | additionally open a PR into the review gate (revert, quarantine a flaky test, config fix) **or** trigger a pre-approved runbook (`rollback`) via CI. Never both silently; say which. |

Any PR you open carries `Change: sdlc/incidents/<id>` and gets the normal AI review + code owner approval.

## Write the artifact

1. `${CLAUDE_PLUGIN_ROOT}/scripts/new-change.sh "<slug>" --incident --owner "<service owner>"`.
2. Fill `sdlc/incidents/<id>/intent.md` in the Stage 1 format: anomaly and evidence, diagnosis, proposed
   outcome, affected systems, constraints, open questions. Leave "Triage decision" blank.
3. Commit on `sdlc/incident/<id>`, open a PR titled `Incident: <title>` assigned to the service owner, label
   `sdlc:incident` and `needs-human` if 3σ. If running headlessly, run the `sdlc:adversarial-reviewer` agent on
   the intent first; on ESCALATE, stop after opening the PR.
4. Post a short summary to the incident thread/channel if `chat.type` is configured.

## Close the loop (after triage)

- Fix now → the intent goes through `/sdlc:spec` (or straight to `/sdlc:plan` for a small, bounded fix; note
  the skipped stage in the plan frontmatter).
- Dismiss → propose the band tuning in `monitoring/bands.yaml` as a PR; dismissals reduce noise.
- When the fix ships → `/sdlc:eval-add <incident id>` and append the post-mortem to `sdlc/lessons.md`.

Report: diagnosis, tier, what you did through which gate, the intent path, and who triages.

From bibutikoley/ai-sdlc-claude, MIT.

More from bibutikoley/ai-sdlc-claude