Incident Response Assistant

---
name: incident
scope: universal
description: |
  Guide incident response, root cause analysis, and post-mortem documentation.
  Use when: production incident, outage response, post-mortem writing, RCA.
  Not for: designing retries and checkpoints before failure — use /durable; setting alert thresholds and Error Budget policy — use /slo.
  Keywords: incident, outage, post-mortem, RCA, root cause.
allowed-tools: Read, Write, Grep, Glob
argument-hint: "[incident description or severity | 事故描述或嚴重程度]"
---

# Incident Response Assistant | 事故回應助手

> **Language**: English | [繁體中文](../../locales/zh-TW/skills/incident-response-assistant/SKILL.md)

Guide structured incident response from detection through post-mortem.

引導結構化的事故回應流程，從偵測到事後檢討。

## Severity Classification | 嚴重程度分類

| Level | Name | Criteria | 標準 | Response Time |
|-------|------|----------|------|---------------|
| **SEV-1** | Critical 重大 | Full service outage, data loss | 全面服務中斷、資料遺失 | Immediate (< 15 min) |
| **SEV-2** | High 高 | Major feature degraded, partial outage | 主要功能降級、部分中斷 | < 30 min |
| **SEV-3** | Medium 中 | Minor feature affected, workaround exists | 次要功能受影響、有替代方案 | < 4 hours |
| **SEV-4** | Low 低 | Cosmetic issue, minimal user impact | 外觀問題、最小用戶影響 | Next business day |

## Response Workflow | 回應工作流程

```
DETECT ──► TRIAGE ──► MITIGATE ──► RESOLVE ──► POST-MORTEM ──► IMPROVE
偵測         分級        緩解          解決         事後檢討       持續改善
```

### 1. Detect — Identify the Incident | 偵測事故
- Monitor alerts, user reports, error spikes
- 監控告警、使用者回報、錯誤量飆升

### 2. Triage — Classify Severity | 分級嚴重程度
- Assign SEV level, identify Incident Commander (IC)
- 指定嚴重等級、識別事故指揮官（IC）

### 3. Mitigate — Reduce Impact | 緩解影響
- Apply temporary fix: rollback, feature flag, traffic shift
- 套用暫時修復：回滾、功能開關、流量切換

### 4. Resolve — Permanent Fix | 永久修復
- Root cause analysis, implement proper fix, deploy
- 根因分析、實作正確修復、部署

### 5. Post-Mortem — Document & Analyze | 事後檢討
- Document timeline, impact, root cause, action items
- 記錄時間軸、影響範圍、根因、行動項目

### 6. Improve — Track & Prevent | 持續改善
- Track action item completion, analyze incident trends, prevent recurrence
- 追蹤行動項目完成度、分析事故趨勢、防止再發

## Post-Mortem Template | 事後檢討模板

```markdown
## Post-Mortem: [Incident Title]
**Date**: YYYY-MM-DD  |  **Severity**: SEV-N  |  **Duration**: Xh Ym

### Timeline
| Time | Event |
|------|-------|
| HH:MM | Alert triggered / 告警觸發 |
| HH:MM | IC assigned / 指派事故指揮官 |
| HH:MM | Mitigation applied / 套用緩解措施 |
| HH:MM | Resolved / 解決 |

### Impact
- Users affected / 受影響用戶數: N
- Revenue impact / 營收影響: $N
- SLA breach / SLA 違反: Yes/No

### Root Cause
[Description of the underlying cause / 根本原因描述]

### Action Items
| Action | Owner | Due Date | Priority | Status |
|--------|-------|----------|----------|--------|
| [Fix] | @name | YYYY-MM-DD | P0 | Open |

### Incident Metrics
- MTTR (Mean Time To Recovery): Xh Ym
- Detection Time: Xm (alert to IC assigned)
- Recurrence: First / Repeat (link to previous)
```

## Communication Template | 溝通模板

```
[SEV-N] [Service Name] — [Brief Description]
Status: Investigating / Mitigating / Resolved
Impact: [Who is affected and how]
Next update: [Time]
```

## Usage | 使用方式

```bash
/incident                       # Show full incident response guide | 顯示完整事故回應指南
/incident "API 500 errors"      # Guided response for specific incident | 特定事故引導回應
/incident --post-mortem         # Generate post-mortem template | 產生事後檢討模板
/incident --sev1                # SEV-1 rapid response checklist | SEV-1 快速回應清單
/incident --actions             # List open action items | 列出未完成行動項目
/incident --metrics             # Show incident trends | 顯示事故趨勢指標
```

## Improvement Tracking | 改善追蹤

### Action Item Lifecycle | 行動項目生命週期

```
Open ──► In Progress ──► Done ──► Verified
```

| Status | Description | 說明 |
|--------|-------------|------|
| **Open** | Identified, not started | 已識別，未開始 |
| **In Progress** | Being worked on | 進行中 |
| **Done** | Fix implemented | 已實作修復 |
| **Verified** | Confirmed effective | 已驗證有效 |

### Incident Storage | 事故存放

```
docs/incidents/
├── INC-2026-03-15-api-outage.md
├── INC-2026-03-20-db-pool-exhaustion.md
└── README.md    # Index (optional)
```

### Metrics Tracked | 追蹤指標

| Metric | Description | 說明 |
|--------|-------------|------|
| **MTTR** | Mean Time To Recovery | 平均恢復時間 |
| **MTTD** | Mean Time To Detection | 平均偵測時間 |
| **Frequency** | Incidents per period | 每期事故數 |
| **Recurrence** | Repeated root causes | 重複根因比例 |
| **Action Completion** | % of actions done | 行動項目完成率 |

## Next Steps Guidance | 下一步引導

After `/incident` completes, the AI assistant should suggest:

> **事故回應指引已提供。建議下一步 / Incident response guidance provided. Suggested next steps:**
> - 提交修復 → 執行 `/commit` 建立修復提交 ⭐ **Recommended / 推薦** — Create fix commit
> - 程式碼審查 → 執行 `/code-review` 審查修復變更 — Review fix changes
> - 記錄學習 → 執行 `/docs` 更新文件 — Document learnings
> - 安全審查 → 執行 `/security` 檢查安全影響 — Check security impact
> - 團隊回顧 → 執行 `/retrospective`（SEV-1/SEV-2 建議）— Team retrospective (recommended for SEV-1/2)
> - 查看行動項目 → 執行 `/incident --actions` — View open action items

## Reference | 參考

- Core standard: [deployment-standards.md](../../core/deployment-standards.md)
- Core standard: [logging.md](../../core/logging-standards.md)

## Version History | 版本歷史

| Version | Date | Changes | 變更說明 |
|---------|------|---------|----------|
| 1.1.0 | 2026-03-26 | Add IMPROVE phase, action tracking, metrics | 新增改善階段、行動追蹤、指標 |
| 1.0.0 | 2026-03-24 | Initial release | 初始版本 |


## AI Agent Behavior | AI 代理行為

> 完整的 AI 行為定義請參閱對應的命令文件：[`/incident`](../commands/incident.md#ai-agent-behavior--ai-代理行為)
>
> For complete AI agent behavior definition, see the corresponding command file: [`/incident`](../commands/incident.md#ai-agent-behavior--ai-代理行為)

## License | 授權

CC BY 4.0 — Documentation content