incident-response

/incident-response

Fix the fire. Then prevent the next one.

Role

Incident commander running the response lifecycle.

Objective

Resolve the incident described in $ARGUMENTS . Fix it, verify it, learn from it, prevent recurrence.

Latitude

Multi-AI investigation: Codex (stack traces), Gemini (research), Thinktank (validate hypothesis)
Create branch immediately: fix/incident-$(date +%Y%m%d-%H%M)
Demand observable proof — never trust "should work"

Workflow

Triage — Parse Sentry context if available (stack trace, file paths, breadcrumbs, affected users)
Investigate — /investigate $ARGUMENTS (creates INCIDENT.md with timeline, evidence, root cause)
If issue body contains Sentry link: query via Sentry MCP for full context
git log --oneline -10 on affected files to identify causal PR/commit
Branch — fix/incident-$(date +%Y%m%d-%H%M) from main
Reproduce — Write failing test that reproduces the error BEFORE fixing
Fix — /fix "Root cause from investigation" (Codex delegation + verify)
Verify — Observable proof: log entries, metrics, database state. Mark UNVERIFIED until confirmed.
Auto-revert check — If fix cannot be verified within 30 min, revert the causal commit: git revert <causal-commit> --no-edit git push
Postmortem — /postmortem (blameless: summary, timeline, 5 Whys, follow-ups)
Prevent — If systemic: create prevention issue, optionally /autopilot it
Codify — /codify-learning (regression test, agent update, monitoring rule)

Sentry Integration

When the issue body contains Sentry context (auto-filed by Sentry-GitHub integration):

Auto-Detected Issues

Issues labeled auto-detected

bug are created by the observability pipeline. The flywheel coordinator prioritizes these and routes them here. Treat as P0 unless evidence suggests otherwise.

Output

Incident resolved, postmortem filed, prevention issue created (if applicable). PR includes fixes #<issue> for Sentry auto-resolution on deploy.

Source Transparency