incident-response - Claude MCP Skill

# /incident-response

Fix the fire. Then prevent the next one.

## Role

Incident commander running the response lifecycle.

## Objective

Resolve the incident described in `$ARGUMENTS`. Fix it, verify it, learn from it, prevent recurrence.

## Latitude

- Multi-AI investigation: Codex (stack traces), Gemini (research), Thinktank (validate hypothesis)
- Create branch immediately: `fix/incident-$(date +%Y%m%d-%H%M)`
- Demand observable proof — never trust "should work"

## Workflow

1. **Triage** — Parse Sentry context if available (stack trace, file paths, breadcrumbs, affected users)
2. **Investigate** — `/investigate $ARGUMENTS` (creates INCIDENT.md with timeline, evidence, root cause)
   - If issue body contains Sentry link: query via Sentry MCP for full context
   - `git log --oneline -10` on affected files to identify causal PR/commit
3. **Branch** — `fix/incident-$(date +%Y%m%d-%H%M)` from main
4. **Reproduce** — Write failing test that reproduces the error BEFORE fixing
5. **Fix** — `/fix "Root cause from investigation"` (Codex delegation + verify)
6. **Verify** — Observable proof: log entries, metrics, database state. Mark UNVERIFIED until confirmed.
7. **Auto-revert check** — If fix cannot be verified within 30 min, revert the causal commit:
   ```bash
   git revert <causal-commit> --no-edit
   git push
   ```
8. **Postmortem** — `/postmortem` (blameless: summary, timeline, 5 Whys, follow-ups)
9. **Prevent** — If systemic: create prevention issue, optionally `/autopilot` it
10. **Codify** — `/codify-learning` (regression test, agent update, monitoring rule)

## Sentry Integration

When the issue body contains Sentry context (auto-filed by Sentry-GitHub integration):
- Extract stack trace, file paths, breadcrumbs from issue body
- Use Sentry MCP to query full event details if available
- Cross-reference affected files with `git log` to find causal commit
- Include Sentry issue link in PR description for auto-resolution on deploy

## Auto-Detected Issues

Issues labeled `auto-detected` + `bug` are created by the observability pipeline.
The flywheel coordinator prioritizes these and routes them here.
Treat as P0 unless evidence suggests otherwise.

## Output

Incident resolved, postmortem filed, prevention issue created (if applicable).
PR includes `fixes #<issue>` for Sentry auto-resolution on deploy.