incident-response

Incident response for production outages is standardized through a four-wave workflow with three parallel agents per wave, passing memory and wave outputs between waves to triage, determine root cause, implement remediation, and document post-incident review.

Determining root cause for security anomalies is handled by the second wave of the incident response workflow, applying evidence-driven analysis passed from the initial triage wave to identify the underlying issue before remediation.

Yes, this incident management workflow applies to data integrity failures, as well as production outages, critical bugs, security anomalies, and performance degradations, enforcing a standardized four-wave response structure.

Post-incident review documentation is generated in the fourth wave, emitting standardized artifacts like wave_04_post_incident.md and a final incident report that translates evidence-driven analysis into actionable prevention planning.

The structured four-wave incident response requires exactly three parallel agents per wave and enforces a strict sequence, meaning it is designed for standardized triage and may not suit incidents requiring unstructured, ad-hoc troubleshooting outside the workflow.