---
name: incident-debug
description: Use when investigating production incidents, regressions, outages, failed integrations, or unexpected behavior.
---

# Incident Debug

Run evidence-based investigation. Do not guess or stack random fixes.

## Workflow

1. State the incident symptom and impact.
2. Establish timeline: when it started, what changed, who is affected.
3. Reproduce or capture logs from the failing path.
4. Trace request/data flow across component boundaries.
5. Form one hypothesis at a time.
6. Test the hypothesis with the smallest safe check.
7. Apply a minimal fix only after root cause is identified.
8. Verify externally and internally.
9. Write a concise incident note.

## Output

```text
Status:
Impact:
Timeline:
Evidence:
Root Cause:
Fix:
Verification:
Follow-ups:
```

## Rules

- Separate facts from hypotheses.
- Record commands and exact timestamps when possible.
- Avoid restarts or destructive actions until the likely impact is clear.