Close the loop (Stage 6, Maintain) - turn an alert, incident, failing build, security finding or ticket into a diagnosed, evidence-backed intent.md that re-enters the lifecycle. Use when the user pastes an alert, incident, error report or scan finding, or asks to investigate a production problem.
Installs into .claude/skills of the current project.
Are you the author of Triage?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/marin-ai-tech-triage)
---
name: triage
description: Close the loop (Stage 6, Maintain) - turn an alert, incident, failing build, security finding or ticket into a diagnosed, evidence-backed intent.md that re-enters the lifecycle. Use when the user pastes an alert, incident, error report or scan finding, or asks to investigate a production problem.
argument-hint: "<alert, incident id, finding, or ticket>"
license: "PolyForm-Noncommercial-1.0.0 with sdlc Additional Permissions, or sdlc Commercial License (https://github.com/marin-ai-tech/sdlc)"
compatibility: Requires the sdlc CLI (sdlc) from the sdlc package.
allowed-tools: Bash(sdlc *)
metadata:
author: marin-ai technologies
version: "1"
generatedBy: "sdlc 0.23.7"
---
Close the loop - Stage 6 (Maintain). What production or a scan reveals re-enters the pipeline as an intent; people triage and approve it.
**Harness contract** (applies to every SDLC workflow)
- `sdlc` is the source of truth for lifecycle state. Read it (`sdlc status --change <id> --json`) instead of inferring the stage from the conversation, and re-read artifacts from disk before using them.
- Gates are human decisions. Never run `sdlc approve`, `sdlc reject`, `sdlc waive` or `sdlc tests unlock`, and never edit `.sdlc.yaml`. When a gate needs a person, stop, name the people from the hint (`next.people` in `sdlc next --json`) rather than the role, and give them the exact command to run in their own terminal.
- An answer in chat is never an approval: gate approvals, `track set`, `backlog move`/`drop` and other human decisions happen only as a command the person runs in their own terminal. Offer the choice, explain the consequences, and give the exact command.
- OpenSpec is the specification subsystem: `sdlc openspec <args>` runs the bundled OpenSpec CLI (`list --specs`, `show`, `validate`, `instructions`). Change folders live in `openspec/changes/<id>/`.
- **Change selection**: use the change named in the input. Otherwise run `sdlc status --json`; with exactly one active change use it, with several ask which one. Announce "Using change: <id>".
- **Language**: talk to the person, and write notes and artifacts, in the person's language; when `locale:` is set in `openspec/sdlc.yaml`, use that language. Keep command names, file names, ids and the template headings as they are (sdlc and OpenSpec parse those headings).
- End every workflow with the next step from `sdlc next --json` (the exact command when a person must act).
**Input**: the user's request (a change id, or a description of the work)
If the input is empty, stop and ask the user to paste the alert, incident, error report or finding to triage. Do not invent one and do not create anything until they answer.
**Steps**
1. **Diagnose read-only.** Gather evidence: the alert or finding payload, logs, metrics, recent deploys and commits (`git log --since`), failing CI runs, related specs (`sdlc openspec list --specs`). Reproduce when possible. No fixes, no deploys, no config changes.
2. **Classify.** A bounded fix that fits one small change, or wider work (architectural weakness, repeated pattern). Assess severity and blast radius.
3. **Create the change**:
```bash
sdlc new <name> --kind <incident|bugfix|security> --risk <low|medium|high> --source-type <incident|alert|scan|ticket> --source-ref <id> [--track lite]
```
An agent may request `--track lite` for a bounded fix with no behavior change to specify; the change remains full until a person confirms it with `sdlc track set lite --change <name>`.
4. **Write `intent.md`** (`sdlc instructions intent --change <name> --json`): the anomaly and its evidence in Problem, the desired end state, affected systems, and open questions.
5. **Recommend, do not act**: whether a rollback or runbook should run now (a person triggers it unless it is pre-approved), and which regression eval/test should be added once fixed.
6. **Stop at the gate.** Route to the service or product owner: `sdlc approve intent --change <name>` to fix now, or `sdlc reject intent --change <name> --note "<reason>"` to dismiss (dismissals tune the alert bands).
<!--
Generated by sdlc 0.23.7 (https://github.com/marin-ai-tech/sdlc).
Required Notice: Copyright (c) 2026 marin-ai technologies (https://github.com/marin-ai-tech/sdlc)
License: PolyForm Noncommercial 1.0.0 (https://polyformproject.org/licenses/noncommercial/1.0.0) with the sdlc Additional Permissions, or a commercial license; see https://github.com/marin-ai-tech/sdlc
-->
