analyze-incidentlisted

# /analyze:incident Full incident sub-command in the `/analyze` cluster. Chains three skills: 1. [`incident-commander`](../../../../skills/incident-commander/SKILL.md) — live coordination. 2. [`root-cause-frameworks`](../../../../skills/root-cause-frameworks/SKILL.md) — RCA after mitigation. 3. [`blameless-post-mortem`](../../../../skills/blameless-post-mortem/SKILL.md) — write-up + memory candidate. ## Instructions ### Phase 1 — Live incident coordination Load [`incident-commander`](../../../../skills/incident-commander/SKILL.md) and follow its procedure verbatim: - Open an incident log, assign roles, establish communication cadence. - Drive mitigation loop until impact is contained. - Capture a timeline as the incident progresses. - Write a partial post-mortem skeleton when mitigation is confirmed (title, severity, timeline, impact — root cause can be TBD). **Handoff trigger:** mitigation confirmed → proceed to Phase 2. Per [`analysis-memory-loop.md § 5`](../../../../docs/contracts/analysis-memory-loop.md), the skeleton is acceptable input with open root-cause items. ### Phase 2 — Root-cause analysis Load [`root-cause-frameworks`](../../../../skills/root-cause-frameworks/SKILL.md) and run the appropriate framework (5-whys, fishbone, fault-tree, or STAMP/STPA) against the captured timeline: - Return ranked root-cause candidates with confidence levels. - Present candidates to the user — not a forced verdict. - If root cause remains unresolved, mark the skeleton `s