Incident Response

---
name: incident-response
description: Diagnose and stabilize production incidents, preserve evidence, restore service, and produce actionable follow-up work.
---

# Incident Response

1. Establish impact, start time, affected components, and current state.
2. Preserve logs and state before restarting or mutating systems.
3. Apply the smallest reversible mitigation that restores service.
4. Trace the causal chain with timestamps and correlation identifiers.
5. Verify recovery through user-visible health and backlog drain, not process existence alone.
6. Document root cause, contributing conditions, detection gaps, and concrete prevention items.