git:20260910.c24f346 to git:20260926.be073b9

1 added, 1 removed. Audit A to A.

---

name: incident

description: "Incident response and blameless postmortem — severity, containment steps, diagnosis (logs/metrics/containers via a deployment skill when present), fix/rollback, timeline, root cause, actions; writes docs/ops/incidents/INC-NNN.md."

argument-hint: "[title] [--sev 1-4]"

user-invocable: true

allowed-tools: Read, Glob, Grep, Bash, Write, Edit, Task, AskUserQuestion

model: sonnet

agent: devops-lead

---

# Incident

Reply in the project conversation language (CLAUDE.md → Language); code, identifiers, paths and commit messages stay in English.

Template `incident-postmortem.md`.

## Phase 1: Containment

Severity; what users see; immediate measures (rollback via `/deploy`/the deployment skill, feature kill switch, rate limit) — with confirmation. Security (leak/breach?) → `security-lead` immediately: isolate, rotate secrets, preserve logs.

## Phase 2: Diagnosis

- Logs (delegate verb `logs [service] [--since]` by `docs/deploy-target-contract.md`, or `docker compose logs`), metrics, recent deploys/migrations, `git log`; hypotheses → verification.

+ Logs (delegate verb `logs [service] [--since]` by `.claude/docs/deploy-target-contract.md`, or `docker compose logs`), metrics, recent deploys/migrations, `git log`; hypotheses → verification.

## Phase 3: Fix

`/hotfix` or rollback; verify by metrics.

## Phase 4: Postmortem

Timeline, root cause (system/process, blameless), what worked/did not, actions (fix/prevent/detect) with owners and dates. "May I write `docs/ops/incidents/INC-NNN.md`?" — one `AskUserQuestion`: write (Recommended) · show the draft/diff first · not now. Actions → roadmap. After the "write" answer: `touch .claude/.write-consent` (rule 7 — the consent-guard hook checks the marker).

Verdict: `RESOLVED` | `MITIGATED` | `OPEN`. Next step — one `AskUserQuestion`: stories for the prevent/detect actions (Recommended) · `/hotfix` · close the incident.