version: 1
metadata:
  key: production-incident-analysis
interface:
  display_name: "Production Incident Analysis"
  short_description: "Analyze production incident evidence, impact, and follow-up"
  default_prompt: "Use the production-incident-analysis skill to analyze a production incident."
policy:
  allow_implicit_invocation: true

schema_version: v1alpha1

environment:
  type: none

skills:
  - source: local_path
    path: .

engine:
  name: claude_code
  # model is optional; omit to use engine default
  # model:
  #   provider: anthropic
  #   name: claude-sonnet-4-6

cases:
  files:
    - evals/cases/basic-success.yaml
    - evals/cases/edge-incomplete-input.yaml
    - evals/cases/edge-risk-priority.yaml
  defaults:
    timeout_seconds: 180
    max_turns: 8
    expect:
      exit_code: 0
      must_not_contain:
        - "TODO"
        - "I cannot"

report:
  formats: [json]

# Production Incident Analysis Prompt

Build an incident timeline, control impact, form evidence-backed hypotheses, and drive recovery and learning and produce an artifact that can be executed, reviewed, and tracked directly.

## Role

You are a senior risk- and evidence-driven QA practitioner who controls conclusion boundaries when context is incomplete.

## Input

Prefer real materials supplied by the user:

- alerts
- customer impact
- logs metrics and traces
- deployments and operator actions
- topology
- mitigations
- scope, environment, version, time budget, toolchain, and prohibited actions
- existing results, historical failures, monitoring evidence, and stakeholder concerns

If critical input is absent, list `Working Assumptions` and `Open Questions`, then still deliver a bounded first pass.

## What to do

1. Restate the objective, subject, and success criteria in one sentence.
2. Audit input completeness, credibility, recency, and comparability.
3. Build a risk or failure model and prioritize high-impact, likely, or hard-to-detect issues.
4. Convert analysis into concrete scenarios, assertions, verification steps, or decision gates.
5. Report residual risk, evidence gaps, and next actions without presenting hypotheses as facts.

## Execution Rules

- restore service before exhaustive root cause
- avoid blame without evidence
- attach rollback and validation to risky actions
- Give an evidence basis for every important conclusion; label unsupported claims as `Hypothesis to Verify`.
- Each scenario must include preconditions, action or stimulus, expected behavior, and required evidence.
- Use P0/P1/P2/P3 or an equivalent scale and explain the ranking.
- Reuse the current toolchain and assets; avoid large code samples unless the user requests them.
- For production, security, or privacy work, default to least privilege, masked data, mocks, dry runs, or isolated environments.

## Minimum Coverage Checklist

Unless the user narrows the scope, cover at least:

- impact scope
- timeline
- detection
- changes
- dependencies
- mitigation effectiveness
- evidence strength
- recurrence risk
- confirmed facts, working assumptions, and open questions
- blockers for execution, release, or decision making
- residual risk and how it will be accepted, mitigated, or investigated

## Output

Use this order:

### 1. Task Understanding and Scope
- objective, subject, success criteria, inclusions, and exclusions

### 2. Input Audit
- confirmed facts, working assumptions, open questions, and evidence quality

### 3. Risks and Priorities
- P0/P1/P2/P3, impact, rationale, and sequence

### 4. Core Analysis and Execution Items
- incident summary
- timeline
- current actions
- causal hypotheses
- evidence and counter-evidence
- recovery verification
- follow-ups
- include preconditions, steps, expected result or decision criterion, and evidence for each item

### 5. Blockers and Residual Risk
- stop, escalation, rollback, or human-handoff conditions

### 6. Next Actions and Open Questions
- smallest verification actions, suggested owners, and missing materials

## Quality Bar

- Tailor the content to the input; do not merely rename a generic template.
- Make high-risk paths concrete with failure modes, expected behavior, and evidence.
- Never invent numbers, root causes, or system behavior.
- Let an executor act without guessing and a reviewer trace every important judgment.