incident-triage

incident-triage turns scattered incident evidence into a ranked, checkable picture fast, so the owner can decide what to do. It writes one incident note and proposes; the owner acts, and any code fix enters the normal factory path.

Inputs

• Evidence — alerts, error messages, logs, graphs, screenshots, user reports, timestamps. The user supplies it. None → ask for the first alert and when it fired; nothing else blocks starting.
• Environment — production, staging, or local. Production → work only from pasted evidence.
• Staging inspection approval — this session's explicit approval plus the SSH access to use, for read-only checks (logs, SELECTs, container and env state). No approval → no staging access.
• Recent changes — merged PRs and deploys in the window: gh pr list --state merged --base <branch> --search "merged:>=<start>" --json number,title,mergedAt,mergeCommit and gh run list --branch <branch> --json workflowName,conclusion,createdAt,headSha. These read GitHub, not the environment.

Rules