incident-response

Files (1)

• SKILL.md

SKILL.md (first lines)

# incident-response

Coordinate, don't firefight solo. This is a triage/dispatch skill that runs inline in the main loop — it plans the dispatch to the same guard agents `${CLAUDE_PLUGIN_ROOT}/agents/ROUTING.md` already defines, in parallel where safe, and keeps one timeline; the main loop invokes the guards.

1. TRIAGE first: what's broken (endpoint/service), since when, blast radius (all users / one tenant / one flow), and is it getting worse. State this in one line before anything else.
2. Stop the bleeding beats root-cause: if a recent deploy/migration/config change correlates with the start time, ask about rollback before deep debugging — rollback is faster and safer than a live fix under pressure. A migration/deploy rollback is itself a guarded action (routes through db-guard/devops-guard, same as any other schema or CI/CD change) — urgency shortens the approval wait, it doesn't skip the guard.
3. State the dispatch plan by signal, same as ROUTING.md Step 3: auth/session broken → security-guard; DB/query errors → db-guard; deploy/infra/CI signal → devops-guard; slow/timeout without errors → performance-guard; anything else with a stack trace → bug-hunter. Mark which of these are independent so the main loop can invoke them in parallel rather than sequentially.
4. Guard agents stay read-only planners even during an incident — urgency compresses the time between plan and approval, it doesn't skip the plan-then-approve step for a guarded area.
5. Keep one running timeline (detected → triaged → root cause found → fix applied → verified) — this becomes the postmortem input; don't let it live only in scrollback.
6. After mitigation: write the postmortem from the timeline (`docs-update` skill) in blameless form — SUMMARY · IMPACT (who, how long, how many) · TIMELINE · ROOT CAUSE · WHAT WENT WELL · ACTION ITEMS (owner + date, each one a prevention or a detection) — and flag any missing metric/alert that would have caught this sooner as `OBS:` (per `${CLAUDE_PLUGIN_ROOT}/rules/700-observability.md`).

From mtvrkan/senior-dev-kit, MIT.

More from mtvrkan/senior-dev-kit