incident-flow

Guides production incident investigation from Telegram report to verified fix.

Updated Jul 28, 2026
One-click install
npx skills add https://github.com/CybernetKZ/sdd-kit --skill incident-flow-cybernetkz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident-flow
Source: https://github.com/CybernetKZ/sdd-kit/tree/main/templates/_migrated/skills/incident-flow
Command: npx skills add https://github.com/CybernetKZ/sdd-kit --skill incident-flow-cybernetkz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Production incidents arrive as loose Telegram messages without structure or ownership, making it hard to move from a raw report to a verified fix. This Skill provides a disciplined workflow for evidence collection, root-cause analysis, and regression-tested fixes. ## Core Features & Use Cases - Evidence Collection: Reads RAISE bug fields, runs the incident_collect tool against a call/campaign uuid, and searches the code graph by symbol before forming any theory. - Root-Cause Documentation: Writes a root-cause document to openspec/changes/<change-id>/intake.md covering timeline, spec deviation, root cause with file:line, and blast radius, then classifies the issue as code bug, client misuse, or infra. - Regression-First Fixes: Requires a test-author agent to write a failing regression test from the incident Scenario before any fix, and verifies the fix by re-running the incident scenario with before/after evidence in the ticket and PR. - Use Case: A teammate pastes "не было end_call со стороны агента, посмотри почему" with a call uuid. The Skill walks you through collecting logs and Redis state, documenting the root cause, and shipping a minimal bugfix branch with a reproducing test. ## Quick Start Paste the incident report or call uuid and ask to investigate this production incident following the incident flow.

Frequently Asked Questions about incident-flow

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a production incident from a Telegram report?▼

Start by reading the RAISE bug fields, then get the call or campaign uuid and run collect_incident.py to pull logs, Redis state, and DB rows. Document the root cause in intake.md before writing any plan or code.

How to write a regression test for a production bug?▼

The test-author agent writes the regression test from the incident Scenario before the fix exists. It must fail on current code for the incident's actual reason; a test that merely errors out does not count as reproduction.

What happens if an incident turns out to be client misuse or infra?▼

The root-cause document becomes the deliverable. Hand it to the owner via a Russian-language ticket comment and status update through the youtrack MCP, then stop with no code change.

Can I skip the spec for an urgent production hotfix?▼

No. Urgency speeds up prioritization, not development. The spec stays mandatory but minimal: why, what, and one Scenario reproducing the incident, with no spec-guard bypass.

Why should I search the code graph by symbol instead of prose?▼

Symbol-based search via graphify explain and query gives precise fan-out and blast radius, while prose search is unreliable. Graph edges marked [INFERRED] are guesses and must be verified in code.