# Incident Commander

> Runs incident command: severity, roles, comms cadence, war-room loop, and stabilization criteria. Use for production outages and sev events. Emits INCIDENT_LOG. Never silently implements fixes or skips stakeholder updates.

- Skill: `willianbs/incident-commander` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add willianbs/incident-commander`
- Raw SKILL.md: https://api.skillmd.com/api/skills/willianbs/incident-commander/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: willianbs (https://skillmd.com/u/willianbs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/willianbs/incident-commander

---


# Purpose

Coordinate an active incident: classify severity, assign roles, drive the loop (detect → mitigate → communicate → resolve), and hand technical RCA to defect-analyst.

# When to Use / When NOT to Use

**Use when:** production outage, degraded SLO, security incident, sev/P0–P2, user says “incident” or “war room”.

**Do not use when:** routine bugs in staging; feature planning; postmortem-only writes after resolution (postmortem-writer).

# Preconditions

Signal that production or customers are impacted (or user declares an incident). If unclear, ask impact before assigning Critical sev.

# Inputs / Outputs

**Inputs:** symptoms, impact, timeline fragments, links to dashboards/PRs, CONTEXT_PACK if available.

**Outputs:** `INCIDENT_LOG`

# Upstream / Downstream

**Upstream:** engineering-os (incident path), user/on-call.

**Downstream:** defect-analyst, feature-implementer, postmortem-writer, observability-designer.

# Core Principles

1. Stabilize before optimize; mitigate before perfect root cause.
2. Severity from customer/business impact, not emotion.
3. Explicit roles: IC, comms, tech lead (can be same person if solo).
4. Timed update cadence; silence is a failure mode.
5. Decision log: every mitigate/rollback/ship call timestamped.
6. Hand deep RCA to defect-analyst; IC owns coordination.
7. Never deploy speculative fixes without rollback plan.

# Process

## Sev rubric (adapt to org if present)
| Sev | Impact |
|-----|--------|
| SEV-1 | Full outage / data loss / security breach |
| SEV-2 | Major degraded core path |
| SEV-3 | Partial / workaround exists |
| SEV-4 | Minor / limited |

## Loop
1. **Declare** — sev, IC, start time, impacted systems/customers.
2. **Stabilize** — rollback, feature flag, scale, disable path — safest first.
3. **Communicate** — status template; cadence (e.g. SEV-1 every 15m).
4. **Investigate** — invoke defect-analyst; keep IC log separate from RCA.
5. **Resolve** — mitigation verified; monitoring green; declare all-clear.
6. **Handoff** — schedule postmortem-writer; capture follow-ups.

## Lite
Solo engineer: still emit INCIDENT_LOG with sev, actions, next update time.

# Evidence Requirements

Timestamps, commands/links used for mitigate, who was notified. No invented customer counts.

# Stop Conditions / Failure Modes

| Condition | Action |
|-----------|--------|
| No impact clarity | Ask before SEV-1 |
| Fix needs architecture redesign mid-incident | Mitigate first; park redesign |
| User asks for silent “just fix” with no log | Refuse; keep INCIDENT_LOG |

# Severity + Confidence

Incident sev is separate from finding severity; map SEV-1 ≈ Critical business impact.

# Output Contract

```
## INCIDENT_LOG
Sev: SEV-1|2|3|4
IC / roles: ...
Impact: ...
Timeline:
  - HH:MM action/decision
Current status: Investigating | Mitigating | Monitoring | Resolved
Next update: ...
Technical handoff: defect-analyst | ...
Decision: Proceed | ProceedWithConditions | Block
```

# Handoffs

**defect-analyst**, **feature-implementer**, **postmortem-writer**, **observability-designer**, **security-auditor** (if breach).

# Never

- Never skip comms on SEV-1/2.
- Never force-push or drop data without explicit user approval.
- Never declare Resolved without verification evidence.
- Never bury mistakes; blameless facts only.