# Orchestrator: Incident

Triage → diagnose → fix → postmortem.

## Pipeline

```
[on-call kicks off]
   │
   ▼
triage
   - severity (SEV1..SEV3) based on user impact + scope
   - declare incident; open a channel; assign roles (commander / scribe / comms)
   │
   ▼
diagnose
   - read recent logs by correlation-id; check audit_logs around the time
   - run /debug with the symptom; reproduce if possible
   │
   ▼
mitigate
   - cheapest stop-the-bleed first (feature flag, scale up, route around)
   - communicate ETA to stakeholders
   │
   ▼
fix
   - cause not symptom; add a regression test
   - if migration was a contributor, follow migration-safe-rollback
   │
   ▼
verify
   - error/latency back to baseline; audit logs show recovery
   │
   ▼
postmortem (blameless)
   - use .claude/skills/incident-postmortem/SKILL.md
   - timeline, root cause, impact, action items (owned + dated)
   - if user data exposed: docs/compliance/breach-response-playbook.md
   - record as ADR if architecture changes
```

## Output

Service restored + blameless postmortem with owned action items.
