1
# Incident Runbook
2
3
A structured incident-response workflow: triage, mitigate, communicate, postmortem —
4
with severity-based timers (first update / escalation window) so response doesn't
5
stall, and templates for status updates and a blameless postmortem with tracked action
6
items.
7
8
## When to use
9
10
- An agent is on-call or assisting on-call and a production incident needs a
11
  consistent response process instead of ad-hoc investigation.
12
- Standardizing incident communication cadence across a team.
13
- Writing up a postmortem after an incident is resolved, with a template that forces
14
  concrete action items instead of just narrative.
15
16
## Install
17
18
```bash
19
npx openagents-cli add openagents/incident-runbook
20
```
21
22
| Runtime | Installed to |
23
|---|---|
24
| `claude-code` | `.claude/skills/incident-runbook/` |
25
| `codex` | `.codex/skills/incident-runbook/` |
26
| `generic` | `.openagents/incident-runbook/` |
27
28
## Inputs
29
30
| name | type | required | default | description |
31
|---|---|---|---|---|
32
| `severity` | string | yes | — | `sev1` (critical/full outage), `sev2` (major/degraded), `sev3` (minor/limited impact) |
33
| `incident_channel` | string | no | — | Chat channel/thread to post status updates to |
34
| `escalation_contact` | string | no | — | Who/what to page if not mitigated within the severity's window |
35
36
## Example run
37
38
```
39
> We're seeing 500s on checkout for ~30% of traffic. Sev1. Run the incident runbook.
40
```
41
42
The agent confirms impact against real signals, posts a first status update within 5
43
minutes (sev1 window), builds a timestamped timeline, checks recent deploys for a
44
correlated change, prioritizes rollback over root-cause investigation, escalates if the
45
30-minute sev1 window passes without mitigation, and — once resolved — schedules a
46
blameless postmortem with owned action items.
47
48
## Files
49
50
- `WORKFLOW.md` — triage/mitigate/communicate/postmortem procedure with severity
51
  timers and escalation rules (entry point).
52
- `templates/status-update.md` — status update format (investigating/mitigating/
53
  monitoring/resolved).
54
- `templates/postmortem.md` — blameless postmortem template with a required action
55
  items table.
56
57
## Limitations
58
59
- Timers and escalation windows are defaults from the severity table — adjust them in
60
  `WORKFLOW.md` to match your team's actual SLOs before relying on them.
61
- Assumes the agent has (or a human operator provides) access to deploy history,
62
  monitoring signals, and rollback/failover mechanisms; it doesn't grant that access.
63
- Escalation (paging `escalation_contact`) and posting to `incident_channel` are
64
  side-effectful — confirm the target before the agent sends anything on your behalf.
65