Document what happened during an incident. Creates a factual record of WHAT happened, not WHY. Use when an incident occurs and needs documentation.
Trigger: Use /incident {brief description} to document what happened during an incident.
Purpose: Create a factual record of WHAT happened. Not WHY — that's for /investigate and /rca-bugfix.
This skill is standalone — it can be invoked at any time without prerequisites. It is a pipeline entry point: it creates the incident report that downstream skills require.
If this invocation is part of an active workflow, check docs/findings/*_FINDINGS_TRACKER.md
for a relevant tracker and note it for context, but do not enforce stage requirements.
docs/incidents/{YYYY-MM-DD_HHMM}_{name}.md/investigateDo NOT proceed with investigation or root cause analysis — that is the job of /investigate and /rca-bugfix.
DO: "Backend returned 429 at 14:02:15 UTC" DON'T: "Backend was overwhelmed" or "Rate limiting was misconfigured"
Write to: docs/incidents/{YYYY-MM-DD_HHMM}_{name}.md
Example: docs/incidents/2026-01-22_1630_extraction_hung.md
# Incident: {Brief Title}
**Date**: {YYYY-MM-DD}
**Time**: {HH:MM} - {HH:MM} UTC
**Reported by**: {User / System / Monitoring}
**Status**: Open
---
## What Happened
{Chronological, factual description of events}
- {HH:MM:SS UTC}: {Event 1}
- {HH:MM:SS UTC}: {Event 2}
- {HH:MM:SS UTC}: {Event 3}
---
## Observed Symptoms
- {Symptom 1}
- {Symptom 2}
---
## Systems Affected
- {System/component 1}
- {System/component 2}
---
## Data Points
| Metric | Value |
|--------|-------|
| Records processed | X |
| Error count | X |
| Duration | X min |
---
## Raw Evidence
{Relevant log snippets or error messages}
---
**Incident Logged**: {YYYY-MM-DD HH:MM} UTC
STOP and output this for the user:
Incident logged: docs/incidents/{YYYY-MM-DD_HHMM}_{name}.md
Summary: {One-line factual summary}
Next steps (your choice):
- /investigate {one-line summary}
- /rca-bugfix {one-line summary}
Awaiting your instructions.
CRITICAL PIPELINE RULE: Suggest ONLY the next pipeline step below. Do NOT offer to implement. Do NOT offer to skip /investigate. Do NOT offer alternatives to the pipeline sequence.
Next step: Run /investigate with the incident at docs/incidents/{filename}.md to determine root cause.
Do NOT continue. Do NOT add commentary suggesting any pipeline step could be skipped or is unnecessary. Wait for the user to decide how to proceed.