Incident Hotfix

Use this alongside broader incident-response skills when code-level action is required.

Workflow

1. Classify severity using references/severity-matrix.md
2. Create hotfix branch from current production tag/commit
3. Reproduce and isolate with minimal failing test
4. Patch with rollback plan
5. Run focused CI checks
6. Capture evidence bundle
7. Merge + verify + postmortem actions

Step 1 — Create incident workspace

bash scripts/start_hotfix.sh --id INC-1234 --base main

This creates:

• hotfix/INC-1234-<slug> branch
• docs/incidents/INC-1234/ folder
• starter files for timeline, rollback, and actions

Step 2 — Evidence capture

bash scripts/capture_evidence.sh --id INC-1234

Collects into docs/incidents/INC-1234/evidence/:

• latest commits + diff summary
• changed files list
• local env snapshot (safe subset)
• test output logs

Step 3 — Patch gate

Before PR/merge, ensure:

• failing case reproduced (or clearly documented)
• minimal patch scope
• rollback command documented in ROLLBACK.md
• focused tests pass + no new lint/type failures

Step 4 — Postmortem actions

Use references/action-template.md to convert findings into concrete tasks:

• owner
• due date
• verification criteria

Required outputs

• docs/incidents/<id>/TIMELINE.md
• docs/incidents/<id>/ROLLBACK.md
• docs/incidents/<id>/ACTIONS.md
• docs/incidents/<id>/evidence/ bundle

Notes

• Prefer smallest safe patch over broad refactor during incident.
• If root cause is uncertain, ship containment first, then permanent fix.
• Never merge hotfix without rollback path.