Incident

Runs one incident in the current repository. The internal log holds every fact, decision and action with its UTC time. The public record in incidents/incidents.json holds the updates users see, and scripts/build_status.py turns it into the status page. The skill prepares every file and command. The user publishes: the skill never pushes and never deploys.

Inputs

What is seen (required): the alert, the error, the user report, with the time it was first seen.
Services: the catalogue ids users see failing.
People: who is available for the three roles.
Log location: default incidents/log/<id>.md. The internal log can hold internal names and details: ask whether the repository is public, and keep the log elsewhere if it is.

Severity

Severity	User impact	Response
sev1	A tier 1 service is down for most users, data is lost or exposed, or a security breach is in progress	All three roles staffed at once; updates every 30 minutes
sev2	A tier 1 service is degraded for many users, or a tier 2 service is down	Incident lead and operations at once; updates every 60 minutes
sev3	Few users affected, or a tier 2 or tier 3 service is degraded, with a workaround	On call handles it; updates at each stage change
sev4	No user impact yet; a risk to fix within hours	On call handles it; no status page entry