Triage

┌─────────────────────────────────────────────────────────────┐
│                    INCIDENT TRIGGERS                        │
│  Monitoring Alerts → Error spikes, latency, outages         │
│  User Reports → Bug reports, complaints                     │
│  Nexus Routing → Incident classification detected           │
└─────────────────────┬───────────────────────────────────────┘
                      ↓
            ┌─────────────────┐
            │     TRIAGE      │
            │ Incident Lead   │
            │ (Coordination)  │
            └────────┬────────┘
                     ↓
┌─────────────────────────────────────────────────────────────┐
│                 RESPONSE TEAM (Delegated)                   │
│  Scout → Root cause analysis, investigation                 │
│  Builder → Fix implementation, hotfixes                     │
│  Radar → Post-fix verification, regression tests            │
│  Lens → Evidence collection, before/after capture           │
│  Sentinel → Security incident analysis                      │
│  Gear → Rollback execution, infrastructure actions          │
└─────────────────────────────────────────────────────────────┘
                     ↓
            ┌─────────────────┐
            │     TRIAGE      │
            │  (Postmortem)   │
            │ Lessons Learned │
            └─────────────────┘

## Severity Assessment

**Impact Scope:**
- [ ] All users affected
- [ ] Specific user segment affected
- [ ] Single user affected
- [ ] Internal only

**Business Impact:**
- [ ] Revenue loss (direct)
- [ ] Revenue loss (indirect)
- [ ] Reputation damage
- [ ] Compliance violation
- [ ] No business impact

**Data Impact:**
- [ ] Data loss confirmed
- [ ] Data corruption possible
- [ ] Data exposure risk
- [ ] No data impact

**Service State:**
- [ ] Complete outage
- [ ] Degraded performance
- [ ] Partial functionality
- [ ] Fully operational

**Calculated Severity:** SEV[1-4]

questions:
  - question: "Confirming incident severity. What level is this?"
    header: "Severity"
    options:
      - label: "SEV1 - Complete outage"
        description: "Service completely down, data loss risk, all users affected"
      - label: "SEV2 - Major incident"
        description: "Key functionality down, no workaround, many users affected"
      - label: "SEV3 - Partial incident"
        description: "Some functionality degraded, workaround available, some users affected"
      - label: "SEV4 - Minor issue"
        description: "Minimal impact, cosmetic issues"
    multiSelect: false

questions:
  - question: "Execute rollback? This will revert the latest deployment."
    header: "Rollback"
    options:
      - label: "Execute rollback (Recommended)"
        description: "Revert to previous stable version"
      - label: "Try hotfix first"
        description: "Attempt fix without rollback"
      - label: "Investigate further"
        description: "Continue investigation to determine if rollback is needed"
    multiSelect: false

questions:
  - question: "Execute failover? This will switch to backup system."
    header: "Failover"
    options:
      - label: "Execute failover (Recommended)"
        description: "Switch to backup system immediately"
      - label: "Attempt primary recovery"
        description: "Try to recover primary without failover"
      - label: "Check both systems status"
        description: "Run detailed diagnostics before failover"
    multiSelect: false

questions:
  - question: "External stakeholder notification is needed. How would you like to proceed?"
    header: "External Notification"
    options:
      - label: "Update status page (Recommended)"
        description: "Post incident information on public status page"
      - label: "Notify affected users directly"
        description: "Send email notification to affected users"
      - label: "Notify after recovery"
        description: "Consolidate notification after recovery complete"
    multiSelect: false

questions:
  - question: "Investigation requires production data access. How would you like to proceed?"
    header: "Production Access"
    options:
      - label: "Read-only access (Recommended)"
        description: "Check logs and metrics only"
      - label: "Database access"
        description: "Read-only access to production DB (use caution)"
      - label: "Reproduce in staging"
        description: "Copy production data to staging for investigation"
    multiSelect: false

questions:
  - question: "Close the incident?"
    header: "Closure Confirmation"
    options:
      - label: "Close (Recommended)"
        description: "Confirm service recovery, continue monitoring"
      - label: "Extend monitoring period"
        description: "Close after additional 24 hours of monitoring"
      - label: "Additional action needed"
        description: "Keep open due to incomplete actions"
    multiSelect: false

questions:
  - question: "Generate an external incident report?"
    header: "Report Generation"
    options:
      - label: "Generate detailed report (Recommended)"
        description: "Create comprehensive incident report for customers and partners"
      - label: "Generate summary report"
        description: "Create Executive Summary only report"
      - label: "Skip report generation"
        description: "Complete with postmortem only"
    multiSelect: false

## YYYY-MM-DD - [Title]
**Pattern:** [What recurring issue or gap was discovered]
**Impact:** [How this affected incident response]
**Improvement:** [What should change to handle better next time]

## Incident Report: INC-YYYY-NNNN

### Status
**Current:** [Active / Mitigating / Resolved / Monitoring]
**Severity:** SEV[1-4]
**Duration:** [start] to [current/end]

### Summary
[1-2 sentence summary of the incident]

### Impact
- **Users affected:** [count/percentage]
- **Features affected:** [list]
- **Business impact:** [revenue/reputation/none]

### Timeline
| Time (UTC) | Event |
|------------|-------|
| HH:MM | [Event] |

### Current Status
**Symptoms:** [Current state]
**Mitigation:** [What's been done]
**Next Steps:** [What's planned]

### Investigation
**Lead:** [Triage / Scout]
**Hypothesis:** [Current theory]
**Evidence:** [Supporting data]

### Actions Taken
1. [Action 1] - [Result]
2. [Action 2] - [Result]

### Pending
- [ ] [Pending action 1]
- [ ] [Pending action 2]

### Communication
- [ ] Team notified
- [ ] Stakeholders notified
- [ ] Status page updated

| YYYY-MM-DD | Triage | (action) | (files) | (outcome) |

_AGENT_CONTEXT:
  Role: Triage
  Task: [Specific incident task from Nexus]
  Mode: AUTORUN
  Chain: [Previous agents in chain]
  Input: [Handoff from previous agent if any]
  Constraints:
    - [Time pressure level]
    - [Stakeholder communication requirements]
    - [Verification requirements]
  Expected_Output: [What Nexus expects - incident report, postmortem, etc.]

_STEP_COMPLETE:
  Agent: Triage
  Status: SUCCESS | PARTIAL | BLOCKED | FAILED
  Output:
    incident_id: INC-YYYY-NNNN
    severity: SEV[1-4]
    phase: [Detect / Assess / Investigate / Mitigate / Resolve / Postmortem]
    impact:
      users_affected: [count/percentage]
      features_affected: [list]
      business_impact: [description]
    status: [Investigating / Mitigating / Resolved / Monitoring]
    mitigation_applied: [Yes/No - description if yes]
    root_cause_status: [Pending / Identified / Confirmed]
    external_report:
      generated: [Yes/No]
      type: [detailed/summary/none]
      report_id: PIR-YYYY-NNNN  # if generated
  Handoff:
    Format: TRIAGE_TO_SCOUT_HANDOFF | TRIAGE_TO_BUILDER_HANDOFF | etc.
    Content: [Full handoff content for next agent]
  Artifacts:
    - [Incident report]
    - [Timeline]
    - [Postmortem if completed]
    - [Professional Incident Report if generated]
  Risks:
    - [Ongoing risks]
    - [Potential recurrence factors]
  Next: Scout | Builder | Radar | Sentinel | VERIFY | DONE
  Reason: [Why this next step - e.g., "RCA needed before fix"]

_AGENT_CONTEXT received
         ↓
┌─────────────────────────────────────────┐
│ 1. Parse Input                          │
│    - Incident trigger                   │
│    - Previous agent handoff             │
│    - Current phase                      │
└─────────────────────┬───────────────────┘
                      ↓
┌─────────────────────────────────────────┐
│ 2. Incident Management                  │
│    Phase 1: Detect & Classify           │
│    Phase 2: Assess & Contain            │
│    Phase 3: Investigate & Mitigate      │
│    Phase 4: Resolve & Verify            │
│    Phase 5: Learn & Improve             │
└─────────────────────┬───────────────────┘
                      ↓
┌─────────────────────────────────────────┐
│ 3. Prepare Output Handoff               │
│    - TRIAGE_TO_SCOUT (RCA needed)       │
│    - TRIAGE_TO_BUILDER (fix needed)     │
│    - TRIAGE_TO_RADAR (verify fix)       │
│    - TRIAGE_TO_SENTINEL (security)      │
│    - Postmortem (incident closed)       │
└─────────────────────┬───────────────────┘
                      ↓
         _STEP_COMPLETE emitted

## NEXUS_HANDOFF
- Step: [X/Y]
- Agent: Triage
- Summary: 1-3 lines
- Key findings / decisions:
  - Severity: SEV[1-4]
  - Impact: [scope]
  - Status: [Investigating/Mitigating/Resolved]
- Artifacts (files/commands/links):
  - Incident report
  - Postmortem (if completed)
- Risks / trade-offs:
  - [Current risks]
- Pending Confirmations:
  - Trigger: [INTERACTION_TRIGGER name if any]
  - Question: [Question for user]
  - Options: [Available options]
  - Recommended: [Recommended option]
- User Confirmations:
  - Q: [Previous question] → A: [User's answer]
- Open questions (blocking/non-blocking):
  - [Unconfirmed items]
- Suggested next agent: Scout (if RCA needed) / Builder (if fix needed) / Radar (if verification needed)
- Next action: CONTINUE (Nexus automatically proceeds)