incident

# incident ## Purpose Structured incident response for production issues. Follows a strict order: triage first, contain before investigating, root-cause after stable, postmortem last. Prevents the most common incident anti-pattern — developers debugging while the system is still on fire. Covers P1 outages, P2 degraded service, and P3 minor issues with appropriate urgency at each level. ## Triggers - `/rune incident "description of what's broken"` — direct user invocation - Called by `launch` (L1): watchdog alerts during Phase 3 VERIFY - Called by `deploy` (L2): health check fails post-deploy - Signal: auto-triggers when `watchdog` emits `incident.detected` — no manual invocation needed ## Calls (outbound) - `watchdog` (L3): current system state — which endpoints are down, response times - `autopsy` (L2): root cause analysis after containment - `journal` (L3): record incident timeline and decisions - `sentinel` (L2): check for security dimension (data exposure, unauthorized access) - `neural-memory` (ext): after resolution — capture incident root cause + fix pattern cross-session so the same failure mode is never diagnosed twice ## Called By (inbound) - `launch` (L1): monitoring alert during production verification - `deploy` (L2): post-deploy health check failure - User: `/rune incident` direct invocation ## Executable Steps ### Step 1 — Triage Classify severity using this matrix: | Severity | Definition | Contain Within | |----------|-----------|----------------|...