arthai-marketplace

/incident

Incident triage orchestrator, classifies severity, diagnoses in parallel, routes to /sre, /ci-fix, or /fix based on evidence.

Synopsis

/incident [description]

When to use it

Anything is broken and you don’t know which skill to use, “the site is down”, “CI is failing”, “users are getting timeouts”
A production error, failed deploy, slow database, or alert firing
Not for: a bug where you’ve already run the 4 diagnostic checks (health, deploys, CI, logs) and ruled out alternatives, go straight to /fix; a known CI failure, /ci-fix; routine health checks, /sre

Prerequisites: a git repository (for git log), the GitHub CLI gh (for CI/deploy status), and health endpoints defined in CLAUDE.md’s Environments table. Docker is optional but used for container health checks if running. Richer diagnostics. DB queries, error rates, APM traces, require MCP servers (Sentry, Datadog, Postgres, Redis, etc.), which /calibrate can install for you.

Quickstart

/incident "500 errors on the checkout page"

What you’ll see: an instant severity/type classification, four parallel diagnostic checks completing in under a minute, a correlated diagnosis with confidence score, then automatic routing to the right resolution skill, ending with a verified fix and an incident report.

Examples

/incident "the site is down"      # free-text description — full triage
/incident #234                    # load the incident from a GitHub issue
/incident                         # no args — auto-detect: checks health, CI, recent deploys

What it does

Classify (instant), pattern-matches the description into severity (CRITICAL/HIGH/MEDIUM/LOW) and type (infra, CI, code bug, performance, local ops, data, auth). CRITICAL proceeds with no questions; HIGH/MEDIUM briefly confirm the description; LOW asks whether you want full triage or a quick check, a user-confirmation checkpoint. With the decisions product on (/arth-setup → decisions), /incident accepts --jev off|shadow|enforce and prints one extra line right after the classification, e.g. 🚨 /incident HIGH Infrastructure · jev: shadow (no box, nothing to answer). In enforce mode a confident Jev classification replaces the keyword tables (which remain the fallback), and when Jev later judges the routing consistent with the gathered evidence the challenge in step 4 is skipped. CRITICAL never asks a question, in any mode. In shadow mode (the default after setup) the keyword tables classify exactly as today and the decision is only logged.
Parallel diagnosis (< 60s), spawns 4 cheap agents at once: health endpoints, recent deploys + CI, error signals/logs, and a knowledge-base lookup for similar past incidents. The lookup checks the knowledge graph first for ranked results (ranked by usefulness), then falls back to (or supplements with) manual search over .claude/qa-knowledge/ and .claude/knowledge/ files.
Correlate, combines the four signals through a decision matrix into a root-cause hypothesis with a preliminary confidence level.
Challenge, unless the incident is CRITICAL with high confidence, one or two Haiku devil’s-advocate agents adversarially test the diagnosis. 30–120 seconds of verification here prevents 30+ minutes of chasing the wrong root cause: CRITICAL (medium/low confidence) gets a 30s fast check, HIGH/MEDIUM get a 90s full challenge, LOW gets 120s. Saying “just fix it” at any point skips the challenge.
Verdict gate, computes a confidence score. High score proceeds; mid-range merges the challenger’s insights; low score presents the competing hypotheses and asks you to pick a path, a user-confirmation checkpoint.
Route to resolution, invokes the right skill automatically with all gathered evidence: /sre debug (infra/perf/data), /ci-fix (CI), /fix (code bugs), /restart (local ops). Escalations between skills are automatic.
Verify, report, learn, re-runs health checks, writes an incident report, updates the knowledge base, notifies your team channel (Discord/Slack if configured), and offers a “What’s next?” menu.

Agents spawned

Agent	Model tier	Role
explore-light	haiku	Health endpoint checks
ops (×3)	haiku	Recent deploys + CI, error signals/logs, knowledge-base lookup
qa-challenger	haiku	Devil’s advocate: challenges the primary diagnosis
sre or ops	haiku	Cross-domain verification in full-challenge mode
sre / fix / ci-fix pipeline	sonnet	The routed resolution skill’s agent
completion-verifier	sonnet	Post-resolution completion check: reports `PASS`, `GAPS FOUND`, or `INCONCLUSIVE` verbatim and does not block; you decide whether to rerun

Output & artifacts

Incident report at {project-root}/.claude/qa-knowledge/incidents/<date>-<slug>.md (created automatically after resolution), timeline, root cause, prevention, challenge results
Knowledge base updates: .claude/knowledge/agents/sre.md, .claude/qa-knowledge/bug-patterns.md, .claude/knowledge/skills/incident.md (classification accuracy, recurring patterns), and matching entries written to the knowledge graph via kg-write.sh for incident summaries, bug patterns, and misclassifications (if detected)
Team notifications at each phase if Discord/Slack is configured
Whatever the routed skill produces, e.g. a fix PR from /fix, or a verified infra fix from /sre debug

Troubleshooting

Problem	Fix
`All systems healthy ... Nothing to triage` on no-args run	Auto-detect found no problems: describe the symptom explicitly: `/incident "<what you saw>"`
Diagnosis is inconclusive	`/incident` runs `/sre status` and presents findings with a suggested route: confirm or redirect it
Triage reports missing data sources (no monitoring, no DB access)	Run /calibrate to install the recommended MCP servers: future triage gets richer evidence
Resolution stalls (skill doesn’t resolve in ~15 min)	The orchestrator alerts and presents options; for CRITICAL incidents unresolved in 30 min it suggests a revert

/sre, the infrastructure route; also useful standalone for health checks
/ci-fix, the CI-failure route
/fix, the code-bug route, with full verification pipeline
/restart, the local-ops route
/qa-incident, manually record a known issue without running triage