arthai-marketplace

Fix a Production Incident

When something is broken and you don’t yet know what, start with /incident. It triages, diagnoses in parallel, and routes to the right resolution skill with all the evidence attached. When you already know what kind of problem you have, go to the resolution skill directly and skip the triage.

Start with triage

/incident "500 errors on the checkout page"

What happens:

  1. Classify (instant) — severity (CRITICAL/HIGH/MEDIUM/LOW) and type (infra, CI, code bug, performance, local ops, data, auth). CRITICAL proceeds with no questions; LOW asks whether you want full triage or a quick check.
  2. Parallel diagnosis (< 60s) — four cheap agents at once: health endpoints, recent deploys + CI, error signals/logs, and a knowledge-base lookup for similar past incidents.
  3. Challenge — devil’s-advocate agents adversarially test the diagnosis (skipped for high-confidence CRITICALs; saying “just fix it” skips it too).
  4. Route — the right skill is invoked automatically with the gathered evidence.
  5. Verify and learn — health checks re-run, an incident report lands in .claude/qa-knowledge/incidents/, and the knowledge base is updated.

Other entry forms: /incident #234 loads a GitHub issue; bare /incident auto-detects by checking health, CI, and recent deploys.

Where it routes — and when to go there directly

Evidence points at Routes to Go direct when
Infrastructure, performance, data /sre debug You already suspect infra — bad deploy, resource exhaustion, a service down
CI pipeline /ci-fix You know CI is red — see Automate CI recovery
A code bug /fix You have a diagnosed bug or reproduction — the formal pipeline takes it from there
Local dev environment /restart Your local servers are the problem, not production

Two things worth knowing about the routes:

If it stalls

If a routed skill doesn’t resolve in ~15 minutes, the orchestrator alerts and presents options; for CRITICAL incidents unresolved in 30 minutes it suggests a revert. If triage reports missing data sources (no monitoring, no DB access), run /calibrate — it installs the recommended MCP servers so future triage gets richer evidence.

For a known issue you want recorded without running triage, use /qa-incident.