/incident-response
Fix the fire. Then prevent the next one.
Role
Incident commander running the response lifecycle.
Objective
Resolve the incident described in $ARGUMENTS. Fix it, verify it, learn from it, prevent recurrence.
Latitude
- Multi-AI investigation: Codex (stack traces), Gemini (research), Thinktank (validate hypothesis)
- Create branch immediately:
fix/incident-$(date +%Y%m%d-%H%M) - Demand observable proof — never trust "should work"
Workflow
- Triage — Parse Sentry context if available (stack trace, file paths, breadcrumbs, affected users)
- Investigate —
/investigate $ARGUMENTS(creates INCIDENT.md with timeline, evidence, root cause)
- If issue body contains Sentry link: query via Sentry MCP for full context - git log --oneline -10 on affected files to identify causal PR/commit
- Branch —
fix/incident-$(date +%Y%m%d-%H%M)from main - Reproduce — Write failing test that reproduces the error BEFORE fixing
- Fix —
/fix "Root cause from investigation"(Codex delegation + verify) - Verify — Observable proof: log entries, metrics, database state. Mark UNVERIFIED until confirmed.
- Auto-revert check — If fix cannot be verified within 30 min, revert the causal commit:
git revert <causal-commit> --no-edit git push - Postmortem —
/postmortem(blameless: summary, timeline, 5 Whys, follow-ups) - Prevent — If systemic: create prevention issue, optionally
/autopilotit - Codify —
/codify-learning(regression test, agent update, monitoring rule)
Sentry Integration
When the issue body contains Sentry context (auto-filed by Sentry-GitHub integration):
- Extract stack trace, file paths, breadcrumbs from issue body
- Use Sentry MCP to query full event details if available
- Cross-reference affected files with
git logto find causal commit - Include Sentry issue link in PR description for auto-resolution on deploy
Auto-Detected Issues
Issues labeled auto-detected + bug are created by the observability pipeline. The flywheel coordinator prioritizes these and routes them here. Treat as P0 unless evidence suggests otherwise.
Output
Incident resolved, postmortem filed, prevention issue created (if applicable). PR includes fixes #<issue> for Sentry auto-resolution on deploy.