Incident 9 ACTIVITIES 5 STAGES
About The interrupt path: a page becomes a bounded impact, a mitigation, a cause, and a lesson. Service first, understanding second — the order is the point.
The only path here that interrupts rather than queues, and the only one where
the right first move is to stop the bleeding without understanding why. That
inversion is what makes it a separate process instead of an urgent Bugfix.
What it assumes
Mitigate before diagnosing. ① sits on mitigation because every minute
spent understanding the cause is a minute the service is still down.The durable fix is not this process. It rejoins the ordinary change path,
with a review and a release gate, once the service is back.The lesson is an artifact. An incident that produces no written change to
how the team works has been paid for and not banked.
Reading the tooling here
Two of the six fills sit at assisted, which is the lowest concentration of
delegation in this document, and on purpose: an incident is the worst moment to
be reading a diff you did not write. The single gated-autonomous fill is alert
routing — the one step here with no model in the loop at all.
Source reference/processes/incident.yaml
One file is one process. The page has no write path — the editor is the editor.
Acknowledge Page Detect On-Call Engineer
An unacknowledged page has no owner, and an incident without an owner has no clock.
Consumes Nothing — this is a source activity.
Produces Incident Record
→ Bound Impact , Find Cause , Write Postmortem
Bound Impact Assess On-Call Engineer Release Operator
Severity decides who wakes up and how much risk the mitigation may carry.
Consumes Incident Record
← Acknowledge Page Produces Impact Assessment
→ Communicate Status , Apply Mitigation Recommended tooling here Explore Subagent Claude Code When the signals cannot say who is affected, read the code for who depends on the failing component — the callers bound the blast radius when the dashboards will not.
Communicate Status Assess Product Lead
Silence during an incident is read as a larger incident.
Consumes Impact Assessment
← Bound Impact · handoff Produces Status Update
→ Write Postmortem Tooling OPEN SLOT A draft status update written off the impact assessment, ready for the lead to correct and send. The cost here is not writing the words, it is that whoever writes them is not working the incident.
Apply Mitigation Mitigate On-Call Engineer Release Operator
The fastest action that returns the service to health, even if it is not the fix.
Consumes Impact Assessment
← Bound Impact Produces Mitigation
→ Confirm Recovery ① Recommended tooling here Signal Correlation Observability Stack The service recovered and degraded again — the mitigation treated a symptom. Re-read the signals together before trying a second one.
Confirm Recovery Mitigate On-Call Engineer
Recovery is a measurement, not a feeling — the same signal that paged must go quiet.
Consumes Mitigation
← Apply Mitigation ① Produces Evidence Pack
→ Find Cause
Find Cause Resolve On-Call Engineer Engineer
With the service healthy the cause can be found without a clock on it.
Consumes Evidence Pack
← Confirm Recovery Incident Record
← Acknowledge Page Produces Root Cause
→ Land Durable Fix , Write Postmortem Recommended tooling here /postmortem Claude Code Drafts the timeline from the record while the cause is still being read.
Land Durable Fix Resolve Engineer
The mitigation is debt until the change that replaces it ships on the ordinary gate.
Produces Change Set → leaves the process
Write Postmortem Learn On-Call Engineer Product Lead
The account is written from the record, while the detail is still recoverable.
Consumes Root Cause
← Find Cause Incident Record
← Acknowledge Page Status Update
← Communicate Status Produces Postmortem
→ Queue Follow-Up
Queue Follow-Up Learn Product Lead
A postmortem that ends in prose and not in tracked work changes nothing.
Consumes Postmortem
← Write Postmortem Produces Follow-Up Work → leaves the process
Explore Subagent Claude Code On-Call Engineer Release Operator Engineer
read-only search agent
Sweeps the codebase and returns the conclusion, not the file dumps.
Answers a question about the codebase in a separate context , and
returns the answer rather than the files it read. Write and Edit are
denied to it, so the worst outcome of a wrong answer is a wasted read.
Reach for it when
the question spans more directories than one reading will cover
the answer is one paragraph but finding it means opening thirty files
the main session's context is better spent on the change itself
Where the human stands
delegated-review. Read-only by construction, so the delegation is
genuinely cheap — but the conclusion is still a claim, and a claim that
decides the shape of a change deserves one file opened to confirm it.
Reached for · recommended in Bound Impact When the signals cannot say who is affected, read the code for who depends on the failing component — the callers bound the blast radius when the dashboards will not.
fills the slot in Find Cause
/postmortem Claude Code On-Call Engineer Engineer Product Lead
incident writeup skill
Drafts the timeline from the incident record while detail is recoverable.
Drafts the timeline from what the incident actually left behind — pages,
messages, deploys, dashboards — while the detail is still recoverable.
Why the timing matters
A timeline assembled a week later is assembled from memory, and memory
arranges events so that the eventual cause looks like it was visible from
the start. The record does not do that.
Where the human stands
assisted. The draft is a timeline. Deciding what the incident means —
which contributing factors are worth a follow-up and which are noise — is
the postmortem, and no draft settles it.
Reached for recommended in Find Cause Drafts the timeline from the record while the cause is still being read.
fills the slot in Write Postmortem
Follow-Up Agent Jira + Rovo Product Lead
rovo agent
Turns agreed actions into tracked work with owners.
Turns the actions a review or a postmortem agreed on into tracked issues,
each with an owner, so the agreement survives the meeting that produced
it.
Where the human stands
delegated-review. Creating the issues is clerical. Assigning them is
not — an owner who did not agree to be one is a ticket that ages, and the
document would rather show an unassigned action than a fictional one.
Reached for fills the slot in Queue Follow-Up
Alert Routing Observability Stack On-Call Engineer
paging rule
Puts a page in front of an owner and starts the clock.
Matches a firing alert to whoever is on call for it, pages them, and
starts the clock the response is measured against.
Where the human stands
gated-autonomous. The rule fires on its own, at three in the morning,
with nobody to approve it — which is the entire reason it exists. The
roster it routes against is reviewed by people, not generated.
Reached for fills the slot in Acknowledge Page
Signal Correlation Observability Stack On-Call Engineer Release Operator
query agent
Reads metrics, logs, and traces together to say who is affected.
Reads metrics, logs and traces together and answers the question the first
minutes of an incident turn on: who is affected, and how many of them.
What it cannot do
It bounds the blast radius from what the signals cover. Traffic that never
reached the failing component, or a dependency nobody instrumented, is
invisible to it — and invisible reads as unaffected. When the dashboards
will not say, reading the code for who calls the failing component gives a
bound the signals cannot.
Where the human stands
delegated-review. The correlation is fast and usually right; the
incident lead owns the impact statement, because that is what gets
communicated.
Reached for fills the slot in Bound Impact · recommended in Apply Mitigation The service recovered and degraded again — the mitigation treated a symptom. Re-read the signals together before trying a second one.
Recovery Check Observability Stack On-Call Engineer
signal check
Confirms the same signal that paged has gone quiet, and stayed quiet.
Watches the signal that paged, and confirms it has gone quiet and stayed
quiet for long enough that the quiet means something.
Same signal, deliberately. An incident closed on a different metric than
the one that opened it is closed on a change of subject.
Where the human stands
delegated-review. The check is mechanical. Whether the service has
recovered or merely stopped being asked — a quiet caused by traffic that
gave up rather than by a fix — is a judgment the responder makes.
Reached for fills the slot in Confirm Recovery
Spec ARTIFACT
What the change is for and what it must do, written before anyone builds it.
A spec is done when a reader who was not in the conversation can say what
is in scope and what is not.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Work Plan ARTIFACT
The route from spec to change: the order of the work, what it touches, and
what has to be true before it starts.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Acceptance Criteria ARTIFACT
The checks the change is measured against, agreed before the work begins.
Written as observable outcomes, not as instructions — a criterion that
describes how the work is done cannot fail honestly.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Task List ARTIFACT
The spec cut into pieces small enough that one of them can be finished,
reviewed, and shipped without holding the rest in your head.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Context Notes ARTIFACT
What the code and the history already say about the area being changed:
constraints, prior decisions, and the traps a reader would otherwise walk into.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Draft Change ARTIFACT
The change while it is still being argued with — compiling, incomplete, and
not yet asking anyone for judgment.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Change Set ARTIFACT
The change offered for review: the diff, its tests, and nothing left in it
that its author would not defend.
Produced by Land Durable Fix Resolve · Engineer Consumed by Nobody — it leaves the process here.
Test Suite ARTIFACT
The executable statement of what must keep working. It is the evidence the
rest of the process quotes.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Evidence Pack ARTIFACT
What proves the change does what it claims: test runs, checks, and the
output a reviewer would otherwise have to reproduce by hand.
Produced by Confirm Recovery Mitigate · On-Call Engineer Consumed by Find Cause Resolve · On-Call Engineer, Engineer
Review Verdict ARTIFACT
The reviewer's decision on conformance — the change matches the intent, or
it does not and here is where.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Release Candidate ARTIFACT
A change set that has passed review and is packaged for production, waiting
only on the decision to go.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Release ARTIFACT
The change in production, with the record of when it went and what it
contained.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Bug Report ARTIFACT
The claim that something is wrong, as it arrived — from a user, an alert, or
a colleague. It is a report, not yet a fact.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Reproduction ARTIFACT
The steps that make the bug happen on demand. Until this exists, the root
cause is a hypothesis and any fix is a guess.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Root Cause ARTIFACT
The mechanism that produced the bug, stated deeply enough that the fix is
obvious and the class of bug — not the instance — is closed.
Produced by Find Cause Resolve · On-Call Engineer, Engineer Consumed by Land Durable Fix Resolve · Engineer Write Postmortem Learn · On-Call Engineer, Product Lead
Regression Test ARTIFACT
The test that fails on the old code and passes on the new one. It is what
turns a fix into a guarantee.
Produced by Nothing in this process — it arrives from outside.
Consumed by Nobody — it leaves the process here.
Incident Record ARTIFACT
The live account of an open incident: what is known, what was tried, and
when. Written while it is happening, because memory rewrites it afterwards.
Produced by Acknowledge Page Detect · On-Call Engineer Consumed by Bound Impact Assess · On-Call Engineer, Release Operator Find Cause Resolve · On-Call Engineer, Engineer Write Postmortem Learn · On-Call Engineer, Product Lead
Impact Assessment ARTIFACT
Who is affected and how badly. Severity is set from this, and every
communication downstream quotes it.
Produced by Bound Impact Assess · On-Call Engineer, Release Operator Consumed by Communicate Status Assess · Product Lead Apply Mitigation Mitigate · On-Call Engineer, Release Operator
Status Update ARTIFACT
What people outside the response need to know right now: current state,
what is being done, and when the next update comes.
Produced by Communicate Status Assess · Product Lead Consumed by Write Postmortem Learn · On-Call Engineer, Product Lead
Mitigation ARTIFACT ① THE CONSTRAINT
The action that stops the harm. It is not the fix — a mitigation that is
mistaken for one leaves the cause in place.
Mitigation is the constraint: every minute spent understanding the cause is a minute the service is still down. Restore first, diagnose after — the durable fix rejoins the ordinary change path.
Produced by Apply Mitigation Mitigate · On-Call Engineer, Release Operator Consumed by Confirm Recovery Mitigate · On-Call Engineer
Postmortem ARTIFACT
The account written after the incident closes: what happened, why the system
allowed it, and what changes so the next one is smaller.
Produced by Write Postmortem Learn · On-Call Engineer, Product Lead Consumed by Queue Follow-Up Learn · Product Lead
Follow-Up Work ARTIFACT
The commitments a postmortem makes, handed back to the delivery process as
real work rather than as good intentions.
Produced by Queue Follow-Up Learn · Product Lead Consumed by Nobody — it leaves the process here.
Product Lead ROLE 3 ACTIVITIES 2 FILLED
Owns intent — what to build and why.
Decides what the team builds next and why it is worth building. Holds the
spec and the acceptance criteria, and is the one who can say a change is
out of scope .
Owns
The spec — what the change must do, in the team's own words.Acceptance criteria — the list a reviewer later reads the change against.Scope — the standing authority to say "not in this change".
Delegation posture
Mostly assisted . Intent is the one thing the team cannot hand to a tool,
so the leverage is in drafting and pressure-testing it — grill-me against
the criteria, not a generated spec.
A spec a tool wrote is a spec nobody decided. The ladder tops out here on
purpose.
Owns Communicate Status Assess · open slot Write Postmortem Learn · ASSISTED Queue Follow-Up Learn · DELEGATED + REVIEW
Engineer ROLE 2 ACTIVITIES 1 FILLED
Owns the change and its proof.
Turns a spec into a change set and the evidence that it works. Owns the
code, its tests, and the honesty of both.
A change, end to end
Read the spec and the acceptance criteria — one test per criterion.
Decompose before building; re-decompose when the task turns out bigger.
Implement, run the suite, and hand back the change with its evidence.
Delegation posture
Work Level Implementation delegated-reviewTest writing delegated-reviewDecomposition assisted
This is where delegation runs highest — implementation and test writing are
the work most safely handed over, provided the proof comes back with it .
See Layer 3 — Capability fills for
what each rung claims.
Owns Find Cause Resolve · DELEGATED + REVIEW Land Durable Fix Resolve
Release Operator ROLE 2 ACTIVITIES 1 FILLED
Owns the path to production.
Owns everything between an approved change and a release: packaging,
promotion, the go decision, and the way back if it goes wrong.
The gate
Release runs gated-autonomous — the pipeline builds, tests, and proceeds
unless someone holds the gate. The operator is the one who can hold it.
Always ready to answer
What is in this release?
What breaks if it is wrong?
How do we get back to the previous state, and how long does that take?
Autonomy at the gate is not the absence of a human. It is a human who has
decided not to intervene yet .
Owns Bound Impact Assess · ASSISTED Apply Mitigation Mitigate
On-Call Engineer ROLE 6 ACTIVITIES 5 FILLED
Owns service health while an incident is open.
Holds the service while an incident is open — assessing impact, mitigating
harm, and keeping the record straight so the postmortem has something true
to read.
While the incident is open
Assess — who is affected, how badly, and since when.Mitigate — the smallest change that stops the harm, not the right fix.Record — a timeline written as it happens , never reconstructed after.
Delegation posture
Speed matters most here, which is exactly why the gates stay human. A
mitigation the on-call did not choose is a second incident.
Owns Acknowledge Page Detect · GATED AUTO Bound Impact Assess · ASSISTED Apply Mitigation Mitigate Confirm Recovery Mitigate · DELEGATED + REVIEW Find Cause Resolve · DELEGATED + REVIEW Write Postmortem Learn · ASSISTED
Claude Code HARNESS 2 TOOLS
Agentic CLI — skills, plan mode, subagents.
An agentic CLI that works in the repository: reads the code, runs commands,
and edits files under review. Skills, plan mode, and subagents are how a
team encodes its own practice into it.
Its reach is the reason most of the delivery process can be delegated at
all — and the reason review stays the gate.
What lives on this shelf
Kind Examples Encoded practice skills, CLAUDE.md, scoped rule files Bounded delegation plan mode, read-only subagents Deterministic gates lifecycle hooks, permission rules Unattended runs batch scripts, machine-readable results
The last row runs with nobody there to answer a question, so the judgment
moves out of the session and into what is written before it starts — the
prompt, the permitted actions, the exit condition. Same agent, same shelf;
what changes is when the thinking happens, not where it runs.
The row above it is the one that changes the ladder. Instructions to the agent
are advisory and a long session forgets them; a hook is a script at a fixed
point that does not negotiate. Where this team runs gated-autonomous
inside a session, it is a hook doing the holding.
Tools Explore Subagent read-only search agent · 2 uses /postmortem incident writeup skill · 2 uses
GitHub Actions HARNESS 0 TOOLS
Agent work triggered by what happens on the repository.
Runs the agent in response to repository events — an issue opened, a pull
request raised, a mention in a comment — inside a runner, under the app's
own permissions. Nobody's laptop is involved and no one has to remember to
start it.
What it changes
Work arrives where the conversation already is. A question asked on an
issue gets answered on that issue, and the answer is visible to everyone
who will later ask why the change looks like this.
Where the human stands
Deliberately low on the ladder here. An automated comment on every pull
request is a second pair of eyes, never a verdict — this team keeps the
verdict human, and an agent that posts on every change is not the thing
that should be allowed to approve one.
Tools Nothing on the shelf runs in it yet.
Jira + Rovo HARNESS 1 TOOLS
Work tracking with Rovo agents.
Where work is tracked and where the team's written history lives. Rovo
agents act inside that record rather than beside it, which is what makes
planning and decomposition delegable.
Tools Follow-Up Agent rovo agent · 1 uses
CI Pipeline HARNESS 0 TOOLS
Build, test, and release automation.
The automation that builds, tests, and ships. It is the only harness that
routinely runs gated-autonomous : it proceeds on its own and a human
holds the stop.
Tools Nothing on the shelf runs in it yet.
Observability Stack HARNESS 3 TOOLS
Metrics, logs, traces, and alert routing.
Metrics, logs, traces, and the alert routing on top of them. It is what
turns "something is wrong" into an impact assessment, and what the incident
process reads from throughout.
Tools Alert Routing paging rule · 1 uses Signal Correlation query agent · 2 uses Recovery Check signal check · 1 uses
Task bigger than planned EVENT 0 RECOMMENDATIONS
Mid-task the work turns out larger than its plan — stop and re-decompose before pushing on.
Reached for when it happens Defined, but nothing is bound to it yet.
Spec is ambiguous EVENT 0 RECOMMENDATIONS
Two readings of the spec survive contact with the work.
Reached for when it happens Defined, but nothing is bound to it yet.
Rework requested EVENT 0 RECOMMENDATIONS
The review verdict comes back with required changes.
Reached for when it happens Defined, but nothing is bound to it yet.
Cannot reproduce EVENT 0 RECOMMENDATIONS
The report does not reproduce on demand — the bug is a hypothesis until it does.
Reached for when it happens Defined, but nothing is bound to it yet.
Blast radius unknown EVENT 1 RECOMMENDATIONS
The signals do not yet say who is affected or how badly — severity cannot be set.
Reached for when it happens Explore Subagent in Bound Impact
Mitigation does not hold EVENT 1 RECOMMENDATIONS
The service recovers and degrades again — the mitigation treated a symptom.
Reached for when it happens Signal Correlation in Apply Mitigation
Context is full EVENT 0 RECOMMENDATIONS
The session has read more than it can hold, and decisions made earlier stop being honoured.
Reached for when it happens Defined, but nothing is bound to it yet.
Same failure survives correction EVENT 0 RECOMMENDATIONS
Two corrections in, the same thing is still wrong, and the history is now mostly failed approaches.
Reached for when it happens Defined, but nothing is bound to it yet.
No check to run EVENT 0 RECOMMENDATIONS
The work looks done and nothing in the repository produces a pass or a fail on it.
Reached for when it happens Defined, but nothing is bound to it yet.
Question has no edges EVENT 0 RECOMMENDATIONS
A question was asked without a boundary, and the reading it needs has no natural end.
Reached for when it happens Defined, but nothing is bound to it yet.
Verdict is about a class, not a change EVENT 0 RECOMMENDATIONS
The finding would apply to the next change too — it is a rule, not a defect.
Reached for when it happens Defined, but nothing is bound to it yet.
Work splits into independent units EVENT 0 RECOMMENDATIONS
The task is many similar pieces that do not depend on each other.
Reached for when it happens Defined, but nothing is bound to it yet.
Approving without reading EVENT 0 RECOMMENDATIONS
Enough permission prompts have gone by that clicking has replaced reading.
Reached for when it happens Defined, but nothing is bound to it yet.