arthai-marketplace

/incident

Incident triage orchestrator — classifies severity, diagnoses in parallel, routes to /sre, /ci-fix, or /fix based on evidence.

Synopsis

/incident [description]

When to use it

Anything is broken and you don’t know which skill to use — “the site is down”, “CI is failing”, “users are getting timeouts”
A production error, failed deploy, slow database, or alert firing
Not for: a bug where you’ve already run the 4 diagnostic checks (health, deploys, CI, logs) and ruled out alternatives — go straight to /fix; a known CI failure — /ci-fix; routine health checks — /sre

Prerequisites: a git repository (for git log), the GitHub CLI gh (for CI/deploy status), and health endpoints defined in CLAUDE.md’s Environments table. Docker is optional but used for container health checks if running. Richer diagnostics — DB queries, error rates, APM traces — require MCP servers (Sentry, Datadog, Postgres, Redis, etc.), which /calibrate can install for you.

Quickstart

/incident "500 errors on the checkout page"

What you’ll see: an instant severity/type classification, four parallel diagnostic checks completing in under a minute, a correlated diagnosis with confidence score, then automatic routing to the right resolution skill — ending with a verified fix and an incident report.

Examples

/incident "the site is down"      # free-text description — full triage
/incident #234                    # load the incident from a GitHub issue
/incident                         # no args — auto-detect: checks health, CI, recent deploys

What it does

Classify (instant) — pattern-matches the description into severity (CRITICAL/HIGH/MEDIUM/LOW) and type (infra, CI, code bug, performance, local ops, data, auth). CRITICAL proceeds with no questions; HIGH/MEDIUM briefly confirm the description; LOW asks whether you want full triage or a quick check — a user-confirmation checkpoint.
Parallel diagnosis (< 60s) — spawns 4 cheap agents at once: health endpoints, recent deploys + CI, error signals/logs, and a knowledge-base lookup for similar past incidents. The lookup checks the knowledge graph first for ranked results (ranked by usefulness), then falls back to (or supplements with) manual search over .claude/qa-knowledge/ and .claude/knowledge/ files.
Correlate — combines the four signals through a decision matrix into a root-cause hypothesis with a preliminary confidence level.
Challenge — unless the incident is CRITICAL with high confidence, one or two Haiku devil’s-advocate agents adversarially test the diagnosis. 30–120 seconds of verification here prevents 30+ minutes of chasing the wrong root cause: CRITICAL (medium/low confidence) gets a 30s fast check, HIGH/MEDIUM get a 90s full challenge, LOW gets 120s. Saying “just fix it” at any point skips the challenge.
Verdict gate — computes a confidence score. High score proceeds; mid-range merges the challenger’s insights; low score presents the competing hypotheses and asks you to pick a path — a user-confirmation checkpoint.
Route to resolution — invokes the right skill automatically with all gathered evidence: /sre debug (infra/perf/data), /ci-fix (CI), /fix (code bugs), /restart (local ops). Escalations between skills are automatic.
Verify, report, learn — re-runs health checks, writes an incident report, updates the knowledge base, notifies your team channel (Discord/Slack if configured), and offers a “What’s next?” menu.

Agents spawned

Agent	Model tier	Role
explore-light	haiku	Health endpoint checks
ops (×3)	haiku	Recent deploys + CI, error signals/logs, knowledge-base lookup
qa-challenger	haiku	Devil’s advocate — challenges the primary diagnosis
sre or ops	haiku	Cross-domain verification in full-challenge mode
sre / fix / ci-fix pipeline	sonnet	The routed resolution skill’s agent
completion-verifier	sonnet	Post-resolution completion check — reports `PASS`, `GAPS FOUND`, or `INCONCLUSIVE` verbatim and does not block; you decide whether to rerun

Output & artifacts

Incident report at {project-root}/.claude/qa-knowledge/incidents/<date>-<slug>.md (created automatically after resolution) — timeline, root cause, prevention, challenge results
Knowledge base updates: .claude/knowledge/agents/sre.md, .claude/qa-knowledge/bug-patterns.md, .claude/knowledge/skills/incident.md (classification accuracy, recurring patterns), and matching entries written to the knowledge graph via kg-write.sh for incident summaries, bug patterns, and misclassifications (if detected)
Team notifications at each phase if Discord/Slack is configured
Whatever the routed skill produces — e.g. a fix PR from /fix, or a verified infra fix from /sre debug

Troubleshooting

Problem	Fix
`All systems healthy ... Nothing to triage` on no-args run	Auto-detect found no problems — describe the symptom explicitly: `/incident "<what you saw>"`
Diagnosis is inconclusive	`/incident` runs `/sre status` and presents findings with a suggested route — confirm or redirect it
Triage reports missing data sources (no monitoring, no DB access)	Run /calibrate to install the recommended MCP servers — future triage gets richer evidence
Resolution stalls (skill doesn’t resolve in ~15 min)	The orchestrator alerts and presents options; for CRITICAL incidents unresolved in 30 min it suggests a revert

/sre — the infrastructure route; also useful standalone for health checks
/ci-fix — the CI-failure route
/fix — the code-bug route, with full verification pipeline
/restart — the local-ops route
/qa-incident — manually record a known issue without running triage