incidentlisted

# Incident Response Incident: $ARGUMENTS ## Principle — the priority inversion Dev-time debugging (`/diagnose`) is *understand → then fix*; an incident **inverts** this: **stop the harm → preserve the evidence → then understand.** Root-causing while users bleed is the wrong altitude, and "quick fixes" invented under pressure are how one incident becomes two. During the fire, movements go **toward known-good states** (the previous deploy, the flag off, the replica) — never toward novel code written under adrenaline. Everything that touches production is **suggested, never run**: this skill drives the investigation and drafts the exact commands; the user executes them. Speed comes from having the right command ready, not from the agent firing it. ## Phase 0 — Load profile (fast pass) - [ ] Read `.claude/PROJECT.md` — **Commands** (logs / deploy / rollback if present), **Integrations** (monitoring, error tracking — read the live signal there, not guesses), **Architecture** (blast-radius map). - [ ] If PROJECT.md is missing/TEMPLATE: **do not stop** — an incident outranks bootstrap ceremony. Ask the user for the two facts you need now (where are logs? how was the last deploy done?) and note the degraded mode in the report. ## Phase 1 — Triage (minutes, not depth) - [ ] **Impact now**: who/what is affected, since when, how bad — from monitoring/error tracker/logs, stated with numbers ("checkout 5xx at 40% since 14:02"), not adjectives. - [ ] *