Incident Hotfix

Use this alongside broader incident-response skills when code-level action is required.

Workflow

1. Classify severity using references/severity-matrix.md
2. Create hotfix branch from current production tag/commit
3. Reproduce and isolate with minimal failing test
4. Patch with rollback plan
5. Run focused CI checks
6. Capture evidence bundle
7. Merge + verify + postmortem actions

Step 1 — Create incident workspace

bash scripts/start_hotfix.sh --id INC-1234 --base main

This creates: - hotfix/INC-1234-<slug> branch - docs/incidents/INC-1234/ folder - starter files for timeline, rollback, and actions

Step 2 — Evidence capture

bash scripts/capture_evidence.sh --id INC-1234

Collects into docs/incidents/INC-1234/evidence/: - latest commits + diff summary - changed files list - local env snapshot (safe subset) - test output logs

Step 3 — Patch gate

Before PR/merge, ensure: - failing case reproduced (or clearly documented) - minimal patch scope - rollback command documented in ROLLBACK.md - focused tests pass + no new lint/type failures

Step 4 — Postmortem actions

Use references/action-template.md to convert findings into concrete tasks: - owner - due date - verification criteria

Required outputs

• docs/incidents/<id>/TIMELINE.md
• docs/incidents/<id>/ROLLBACK.md
• docs/incidents/<id>/ACTIONS.md
• docs/incidents/<id>/evidence/ bundle

Notes

• Prefer smallest safe patch over broad refactor during incident.
• If root cause is uncertain, ship containment first, then permanent fix.
• Never merge hotfix without rollback path.