Incident triage

Use this Skill when a report may describe a production incident.

1. Separate observed facts from hypotheses.
2. Record impact, affected users, start time, and the latest known good state.
3. Assign a provisional severity and state why.
4. Preserve links to logs, alerts, dashboards, and recent changes without copying secrets.
5. End with the current owner, the next decision, and the next update time.

Do not claim a cause until evidence supports it. Do not include credentials, tokens, or private customer content in the handoff.