25 INCIDENT Development and operations Medium

Incident Response — From Alert to Postmortem

Automated diagnosis, hotfix with verification, and postmortem generation with provenance.

◻ intake ★★☆

△ architect ★★★

◇ vigil ★★☆

⬡ licit ★☆☆

Context

Complete incident response flow: diagnosis via Sentry, fix implementation with checks, hotfix provenance, and postmortem generation.

Flow with 4 tools

△ Phase 01 — architect

Diagnosis and fix

Diagnoses the error and fixes with test and vigil checks.

△ architect

architect run "Diagnose the 500 error in /payments" \
  --agent plan --budget 0.15 > diagnosis.md

architect loop "Fix the bug per diagnosis.md" \
  --check "pytest tests/ -q" \
  --check "vigil scan src/services/payment/" \
  --max-iterations 10

⬡ Phase 02 — licit

Hotfix provenance

Documents whether AI introduced the bug or fixed it.

⬡ licit

licit trace

◻ Phase 03 — intake

Preventive actions

Converts postmortem into spec for improvements.

◻ intake

intake init "Post-incident improvements" \
  --source postmortem.md \
  --format architect