[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70K4WMJKZYP8R8R9NPD2ZAH":3,"skill-same:01M70K4WMJKZYP8R8R9NPD2ZAH":69},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":50,"ownerHtmlUrl":51,"ownerBlogUrl":52,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M70K4WMJKZYP8R8R9NPD2ZAH","incident-runbook-templates",null,"Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use when building runbooks, responding to incidents, or establishing incident response procedures.","shengdabai\u002FTony-Claude-Code-Skills","shengdabai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F116417419?v=4","01M70F6D2WY5PQV5A92BKYJQEW","Tony Sheng","01M70F6D3GAAAYZ5H4CC1G8VXM",3,"MIT","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fincident-response\u002Fskills\u002Fincident-runbook-templates\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"templates","incident runbook templates","incident","runbook","actions","runbooks","create","paths","escalation","use","recovery","when","incident response","incidents","with","structured","2026-11-10 10:12:30",false,"---\nname: incident-runbook-templates\ndescription: Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use when building runbooks, responding to incidents, or establishing incident response procedures.\n---\n\n# Incident Runbook Templates\n\nProduction-ready templates for incident response runbooks covering detection, triage, mitigation, resolution, and communication.\n\n## When to Use This Skill\n\n- Creating incident response procedures\n- Building service-specific runbooks\n- Establishing escalation paths\n- Documenting recovery procedures\n- Responding to active incidents\n- Onboarding on-call engineers\n\n## Core Concepts\n\n### 1. Incident Severity Levels\n\n| Severity | Impact | Response Time | Example |\n|----------|--------|---------------|---------|\n| **SEV1** | Complete outage, data loss | 15 min | Production down |\n| **SEV2** | Major degradation | 30 min | Critical feature broken |\n| **SEV3** | Minor impact | 2 hours | Non-critical bug |\n| **SEV4** | Minimal impact | Next business day | Cosmetic issue |\n\n### 2. Runbook Structure\n\n```\n1. Overview & Impact\n2. Detection & Alerts\n3. Initial Triage\n4. Mitigation Steps\n5. Root Cause Investigation\n6. Resolution Procedures\n7. Verification & Rollback\n8. Communication Templates\n9. Escalation Matrix\n```\n\n## Runbook Templates\n\n### Template 1: Service Outage Runbook\n\n```markdown\n# [Service Name] Outage Runbook\n\n## Overview\n**Service**: Payment Processing Service\n**Owner**: Platform Team\n**Slack**: #payments-incidents\n**PagerDuty**: payments-oncall\n\n## Impact Assessment\n- [ ] Which customers are affected?\n- [ ] What percentage of traffic is impacted?\n- [ ] Are there financial implications?\n- [ ] What's the blast radius?\n\n## Detection\n### Alerts\n- `payment_error_rate > 5%` (PagerDuty)\n- `payment_latency_p99 > 2s` (Slack)\n- `payment_success_rate \u003C 95%` (PagerDuty)\n\n### Dashboards\n- [Payment Service Dashboard](https:\u002F\u002Fgrafana\u002Fd\u002Fpayments)\n- [Error Tracking](https:\u002F\u002Fsentry.io\u002Fpayments)\n- [Dependency Status](https:\u002F\u002Fstatus.stripe.com)\n\n## Initial Triage (First 5 Minutes)\n\n### 1. Assess Scope\n```bash\n# Check service health\nkubectl get pods -n payments -l app=payment-service\n\n# Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Check error rates\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\"\n```\n\n### 2. Quick Health Checks\n- [ ] Can you reach the service? `curl -I https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth`\n- [ ] Database connectivity? Check connection pool metrics\n- [ ] External dependencies? Check Stripe, bank API status\n- [ ] Recent changes? Check deploy history\n\n### 3. Initial Classification\n| Symptom | Likely Cause | Go To Section |\n|---------|--------------|---------------|\n| All requests failing | Service down | Section 4.1 |\n| High latency | Database\u002Fdependency | Section 4.2 |\n| Partial failures | Code bug | Section 4.3 |\n| Spike in errors | Traffic surge | Section 4.4 |\n\n## Mitigation Procedures\n\n### 4.1 Service Completely Down\n```bash\n# Step 1: Check pod status\nkubectl get pods -n payments\n\n# Step 2: If pods are crash-looping, check logs\nkubectl logs -n payments -l app=payment-service --tail=100\n\n# Step 3: Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Step 4: ROLLBACK if recent deploy is suspect\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Step 5: Scale up if resource constrained\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=10\n\n# Step 6: Verify recovery\nkubectl rollout status deployment\u002Fpayment-service -n payments\n```\n\n### 4.2 High Latency\n```bash\n# Step 1: Check database connections\nkubectl exec -n payments deploy\u002Fpayment-service -- \\\n  curl localhost:8080\u002Fmetrics | grep db_pool\n\n# Step 2: Check slow queries (if DB issue)\npsql -h $DB_HOST -U $DB_USER -c \"\n  SELECT pid, now() - query_start AS duration, query\n  FROM pg_stat_activity\n  WHERE state = 'active' AND duration > interval '5 seconds'\n  ORDER BY duration DESC;\"\n\n# Step 3: Kill long-running queries if needed\npsql -h $DB_HOST -U $DB_USER -c \"SELECT pg_terminate_backend(pid);\"\n\n# Step 4: Check external dependency latency\ncurl -w \"@curl-format.txt\" -o \u002Fdev\u002Fnull -s https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Fhealth\n\n# Step 5: Enable circuit breaker if dependency is slow\nkubectl set env deployment\u002Fpayment-service \\\n  STRIPE_CIRCUIT_BREAKER_ENABLED=true -n payments\n```\n\n### 4.3 Partial Failures (Specific Errors)\n```bash\n# Step 1: Identify error pattern\nkubectl logs -n payments -l app=payment-service --tail=500 | \\\n  grep -i error | sort | uniq -c | sort -rn | head -20\n\n# Step 2: Check error tracking\n# Go to Sentry: https:\u002F\u002Fsentry.io\u002Fpayments\n\n# Step 3: If specific endpoint, enable feature flag to disable\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"DISABLE_PROBLEMATIC_FEATURE\", \"enabled\": true}'\n\n# Step 4: If data issue, check recent data changes\npsql -h $DB_HOST -c \"\n  SELECT * FROM audit_log\n  WHERE table_name = 'payment_methods'\n  AND created_at > now() - interval '1 hour';\"\n```\n\n### 4.4 Traffic Surge\n```bash\n# Step 1: Check current request rate\nkubectl top pods -n payments\n\n# Step 2: Scale horizontally\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=20\n\n# Step 3: Enable rate limiting\nkubectl set env deployment\u002Fpayment-service \\\n  RATE_LIMIT_ENABLED=true \\\n  RATE_LIMIT_RPS=1000 -n payments\n\n# Step 4: If attack, block suspicious IPs\nkubectl apply -f - \u003C\u003CEOF\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: block-suspicious\n  namespace: payments\nspec:\n  podSelector:\n    matchLabels:\n      app: payment-service\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 0.0.0.0\u002F0\n        except:\n        - 192.168.1.0\u002F24  # Suspicious range\nEOF\n```\n\n## Verification Steps\n```bash\n# Verify service is healthy\ncurl -s https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth | jq\n\n# Verify error rate is back to normal\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\" | jq '.data.result[0].value[1]'\n\n# Verify latency is acceptable\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=histogram_quantile(0.99,sum(rate(http_request_duration_seconds_bucket[5m]))by(le))\" | jq\n\n# Smoke test critical flows\n.\u002Fscripts\u002Fsmoke-test-payments.sh\n```\n\n## Rollback Procedures\n```bash\n# Rollback Kubernetes deployment\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Rollback database migration (if applicable)\n.\u002Fscripts\u002Fdb-rollback.sh $MIGRATION_VERSION\n\n# Rollback feature flag\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"NEW_PAYMENT_FLOW\", \"enabled\": false}'\n```\n\n## Escalation Matrix\n\n| Condition | Escalate To | Contact |\n|-----------|-------------|---------|\n| > 15 min unresolved SEV1 | Engineering Manager | @manager (Slack) |\n| Data breach suspected | Security Team | #security-incidents |\n| Financial impact > $10k | Finance + Legal | @finance-oncall |\n| Customer communication needed | Support Lead | @support-lead |\n\n## Communication Templates\n\n### Initial Notification (Internal)\n```\n🚨 INCIDENT: Payment Service Degradation\n\nSeverity: SEV2\nStatus: Investigating\nImpact: ~20% of payment requests failing\nStart Time: [TIME]\nIncident Commander: [NAME]\n\nCurrent Actions:\n- Investigating root cause\n- Scaling up service\n- Monitoring dashboards\n\nUpdates in #payments-incidents\n```\n\n### Status Update\n```\n📊 UPDATE: Payment Service Incident\n\nStatus: Mitigating\nImpact: Reduced to ~5% failure rate\nDuration: 25 minutes\n\nActions Taken:\n- Rolled back deployment v2.3.4 → v2.3.3\n- Scaled service from 5 → 10 replicas\n\nNext Steps:\n- Continuing to monitor\n- Root cause analysis in progress\n\nETA to Resolution: ~15 minutes\n```\n\n### Resolution Notification\n```\n✅ RESOLVED: Payment Service Incident\n\nDuration: 45 minutes\nImpact: ~5,000 affected transactions\nRoot Cause: Memory leak in v2.3.4\n\nResolution:\n- Rolled back to v2.3.3\n- Transactions auto-retried successfully\n\nFollow-up:\n- Postmortem scheduled for [DATE]\n- Bug fix in progress\n```\n```\n\n### Template 2: Database Incident Runbook\n\n```markdown\n# Database Incident Runbook\n\n## Quick Reference\n| Issue | Command |\n|-------|---------|\n| Check connections | `SELECT count(*) FROM pg_stat_activity;` |\n| Kill query | `SELECT pg_terminate_backend(pid);` |\n| Check replication lag | `SELECT extract(epoch from (now() - pg_last_xact_replay_timestamp()));` |\n| Check locks | `SELECT * FROM pg_locks WHERE NOT granted;` |\n\n## Connection Pool Exhaustion\n```sql\n-- Check current connections\nSELECT datname, usename, state, count(*)\nFROM pg_stat_activity\nGROUP BY datname, usename, state\nORDER BY count(*) DESC;\n\n-- Identify long-running connections\nSELECT pid, usename, datname, state, query_start, query\nFROM pg_stat_activity\nWHERE state != 'idle'\nORDER BY query_start;\n\n-- Terminate idle connections\nSELECT pg_terminate_backend(pid)\nFROM pg_stat_activity\nWHERE state = 'idle'\nAND query_start \u003C now() - interval '10 minutes';\n```\n\n## Replication Lag\n```sql\n-- Check lag on replica\nSELECT\n  CASE\n    WHEN pg_last_wal_receive_lsn() = pg_last_wal_replay_lsn() THEN 0\n    ELSE extract(epoch from now() - pg_last_xact_replay_timestamp())\n  END AS lag_seconds;\n\n-- If lag > 60s, consider:\n-- 1. Check network between primary\u002Freplica\n-- 2. Check replica disk I\u002FO\n-- 3. Consider failover if unrecoverable\n```\n\n## Disk Space Critical\n```bash\n# Check disk usage\ndf -h \u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n\n# Find large tables\npsql -c \"SELECT relname, pg_size_pretty(pg_total_relation_size(relid))\nFROM pg_catalog.pg_statio_user_tables\nORDER BY pg_total_relation_size(relid) DESC\nLIMIT 10;\"\n\n# VACUUM to reclaim space\npsql -c \"VACUUM FULL large_table;\"\n\n# If emergency, delete old data or expand disk\n```\n```\n\n## Best Practices\n\n### Do's\n- **Keep runbooks updated** - Review after every incident\n- **Test runbooks regularly** - Game days, chaos engineering\n- **Include rollback steps** - Always have an escape hatch\n- **Document assumptions** - What must be true for steps to work\n- **Link to dashboards** - Quick access during stress\n\n### Don'ts\n- **Don't assume knowledge** - Write for 3 AM brain\n- **Don't skip verification** - Confirm each step worked\n- **Don't forget communication** - Keep stakeholders informed\n- **Don't work alone** - Escalate early\n- **Don't skip postmortems** - Learn from every incident\n\n## Resources\n\n- [Google SRE Book - Incident Management](https:\u002F\u002Fsre.google\u002Fsre-book\u002Fmanaging-incidents\u002F)\n- [PagerDuty Incident Response](https:\u002F\u002Fresponse.pagerduty.com\u002F)\n- [Atlassian Incident Management](https:\u002F\u002Fwww.atlassian.com\u002Fincident-management)\n","# Incident Runbook Templates\n\nProduction-ready templates for incident response runbooks covering detection, triage, mitigation, resolution, and communication.\n\n## When to Use This Skill\n\n- Creating incident response procedures\n- Building service-specific runbooks\n- Establishing escalation paths\n- Documenting recovery procedures\n- Responding to active incidents\n- Onboarding on-call engineers\n\n## Core Concepts\n\n### 1. Incident Severity Levels\n\n| Severity | Impact | Response Time | Example |\n|----------|--------|---------------|---------|\n| **SEV1** | Complete outage, data loss | 15 min | Production down |\n| **SEV2** | Major degradation | 30 min | Critical feature broken |\n| **SEV3** | Minor impact | 2 hours | Non-critical bug |\n| **SEV4** | Minimal impact | Next business day | Cosmetic issue |\n\n### 2. Runbook Structure\n\n```\n1. Overview & Impact\n2. Detection & Alerts\n3. Initial Triage\n4. Mitigation Steps\n5. Root Cause Investigation\n6. Resolution Procedures\n7. Verification & Rollback\n8. Communication Templates\n9. Escalation Matrix\n```\n\n## Runbook Templates\n\n### Template 1: Service Outage Runbook\n\n```markdown\n# [Service Name] Outage Runbook\n\n## Overview\n**Service**: Payment Processing Service\n**Owner**: Platform Team\n**Slack**: #payments-incidents\n**PagerDuty**: payments-oncall\n\n## Impact Assessment\n- [ ] Which customers are affected?\n- [ ] What percentage of traffic is impacted?\n- [ ] Are there financial implications?\n- [ ] What's the blast radius?\n\n## Detection\n### Alerts\n- `payment_error_rate > 5%` (PagerDuty)\n- `payment_latency_p99 > 2s` (Slack)\n- `payment_success_rate \u003C 95%` (PagerDuty)\n\n### Dashboards\n- [Payment Service Dashboard](https:\u002F\u002Fgrafana\u002Fd\u002Fpayments)\n- [Error Tracking](https:\u002F\u002Fsentry.io\u002Fpayments)\n- [Dependency Status](https:\u002F\u002Fstatus.stripe.com)\n\n## Initial Triage (First 5 Minutes)\n\n### 1. Assess Scope\n```bash\n# Check service health\nkubectl get pods -n payments -l app=payment-service\n\n# Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Check error rates\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\"\n```\n\n### 2. Quick Health Checks\n- [ ] Can you reach the service? `curl -I https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth`\n- [ ] Database connectivity? Check connection pool metrics\n- [ ] External dependencies? Check Stripe, bank API status\n- [ ] Recent changes? Check deploy history\n\n### 3. Initial Classification\n| Symptom | Likely Cause | Go To Section |\n|---------|--------------|---------------|\n| All requests failing | Service down | Section 4.1 |\n| High latency | Database\u002Fdependency | Section 4.2 |\n| Partial failures | Code bug | Section 4.3 |\n| Spike in errors | Traffic surge | Section 4.4 |\n\n## Mitigation Procedures\n\n### 4.1 Service Completely Down\n```bash\n# Step 1: Check pod status\nkubectl get pods -n payments\n\n# Step 2: If pods are crash-looping, check logs\nkubectl logs -n payments -l app=payment-service --tail=100\n\n# Step 3: Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Step 4: ROLLBACK if recent deploy is suspect\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Step 5: Scale up if resource constrained\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=10\n\n# Step 6: Verify recovery\nkubectl rollout status deployment\u002Fpayment-service -n payments\n```\n\n### 4.2 High Latency\n```bash\n# Step 1: Check database connections\nkubectl exec -n payments deploy\u002Fpayment-service -- \\\n  curl localhost:8080\u002Fmetrics | grep db_pool\n\n# Step 2: Check slow queries (if DB issue)\npsql -h $DB_HOST -U $DB_USER -c \"\n  SELECT pid, now() - query_start AS duration, query\n  FROM pg_stat_activity\n  WHERE state = 'active' AND duration > interval '5 seconds'\n  ORDER BY duration DESC;\"\n\n# Step 3: Kill long-running queries if needed\npsql -h $DB_HOST -U $DB_USER -c \"SELECT pg_terminate_backend(pid);\"\n\n# Step 4: Check external dependency latency\ncurl -w \"@curl-format.txt\" -o \u002Fdev\u002Fnull -s https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Fhealth\n\n# Step 5: Enable circuit breaker if dependency is slow\nkubectl set env deployment\u002Fpayment-service \\\n  STRIPE_CIRCUIT_BREAKER_ENABLED=true -n payments\n```\n\n### 4.3 Partial Failures (Specific Errors)\n```bash\n# Step 1: Identify error pattern\nkubectl logs -n payments -l app=payment-service --tail=500 | \\\n  grep -i error | sort | uniq -c | sort -rn | head -20\n\n# Step 2: Check error tracking\n# Go to Sentry: https:\u002F\u002Fsentry.io\u002Fpayments\n\n# Step 3: If specific endpoint, enable feature flag to disable\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"DISABLE_PROBLEMATIC_FEATURE\", \"enabled\": true}'\n\n# Step 4: If data issue, check recent data changes\npsql -h $DB_HOST -c \"\n  SELECT * FROM audit_log\n  WHERE table_name = 'payment_methods'\n  AND created_at > now() - interval '1 hour';\"\n```\n\n### 4.4 Traffic Surge\n```bash\n# Step 1: Check current request rate\nkubectl top pods -n payments\n\n# Step 2: Scale horizontally\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=20\n\n# Step 3: Enable rate limiting\nkubectl set env deployment\u002Fpayment-service \\\n  RATE_LIMIT_ENABLED=true \\\n  RATE_LIMIT_RPS=1000 -n payments\n\n# Step 4: If attack, block suspicious IPs\nkubectl apply -f - \u003C\u003CEOF\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: block-suspicious\n  namespace: payments\nspec:\n  podSelector:\n    matchLabels:\n      app: payment-service\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 0.0.0.0\u002F0\n        except:\n        - 192.168.1.0\u002F24  # Suspicious range\nEOF\n```\n\n## Verification Steps\n```bash\n# Verify service is healthy\ncurl -s https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth | jq\n\n# Verify error rate is back to normal\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\" | jq '.data.result[0].value[1]'\n\n# Verify latency is acceptable\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=histogram_quantile(0.99,sum(rate(http_request_duration_seconds_bucket[5m]))by(le))\" | jq\n\n# Smoke test critical flows\n.\u002Fscripts\u002Fsmoke-test-payments.sh\n```\n\n## Rollback Procedures\n```bash\n# Rollback Kubernetes deployment\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Rollback database migration (if applicable)\n.\u002Fscripts\u002Fdb-rollback.sh $MIGRATION_VERSION\n\n# Rollback feature flag\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"NEW_PAYMENT_FLOW\", \"enabled\": false}'\n```\n\n## Escalation Matrix\n\n| Condition | Escalate To | Contact |\n|-----------|-------------|---------|\n| > 15 min unresolved SEV1 | Engineering Manager | @manager (Slack) |\n| Data breach suspected | Security Team | #security-incidents |\n| Financial impact > $10k | Finance + Legal | @finance-oncall |\n| Customer communication needed | Support Lead | @support-lead |\n\n## Communication Templates\n\n### Initial Notification (Internal)\n```\n🚨 INCIDENT: Payment Service Degradation\n\nSeverity: SEV2\nStatus: Investigating\nImpact: ~20% of payment requests failing\nStart Time: [TIME]\nIncident Commander: [NAME]\n\nCurrent Actions:\n- Investigating root cause\n- Scaling up service\n- Monitoring dashboards\n\nUpdates in #payments-incidents\n```\n\n### Status Update\n```\n📊 UPDATE: Payment Service Incident\n\nStatus: Mitigating\nImpact: Reduced to ~5% failure rate\nDuration: 25 minutes\n\nActions Taken:\n- Rolled back deployment v2.3.4 → v2.3.3\n- Scaled service from 5 → 10 replicas\n\nNext Steps:\n- Continuing to monitor\n- Root cause analysis in progress\n\nETA to Resolution: ~15 minutes\n```\n\n### Resolution Notification\n```\n✅ RESOLVED: Payment Service Incident\n\nDuration: 45 minutes\nImpact: ~5,000 affected transactions\nRoot Cause: Memory leak in v2.3.4\n\nResolution:\n- Rolled back to v2.3.3\n- Transactions auto-retried successfully\n\nFollow-up:\n- Postmortem scheduled for [DATE]\n- Bug fix in progress\n```\n```\n\n### Template 2: Database Incident Runbook\n\n```markdown\n# Database Incident Runbook\n\n## Quick Reference\n| Issue | Command |\n|-------|---------|\n| Check connections | `SELECT count(*) FROM pg_stat_activity;` |\n| Kill query | `SELECT pg_terminate_backend(pid);` |\n| Check replication lag | `SELECT extract(epoch from (now() - pg_last_xact_replay_timestamp()));` |\n| Check locks | `SELECT * FROM pg_locks WHERE NOT granted;` |\n\n## Connection Pool Exhaustion\n```sql\n-- Check current connections\nSELECT datname, usename, state, count(*)\nFROM pg_stat_activity\nGROUP BY datname, usename, state\nORDER BY count(*) DESC;\n\n-- Identify long-running connections\nSELECT pid, usename, datname, state, query_start, query\nFROM pg_stat_activity\nWHERE state != 'idle'\nORDER BY query_start;\n\n-- Terminate idle connections\nSELECT pg_terminate_backend(pid)\nFROM pg_stat_activity\nWHERE state = 'idle'\nAND query_start \u003C now() - interval '10 minutes';\n```\n\n## Replication Lag\n```sql\n-- Check lag on replica\nSELECT\n  CASE\n    WHEN pg_last_wal_receive_lsn() = pg_last_wal_replay_lsn() THEN 0\n    ELSE extract(epoch from now() - pg_last_xact_replay_timestamp())\n  END AS lag_seconds;\n\n-- If lag > 60s, consider:\n-- 1. Check network between primary\u002Freplica\n-- 2. Check replica disk I\u002FO\n-- 3. Consider failover if unrecoverable\n```\n\n## Disk Space Critical\n```bash\n# Check disk usage\ndf -h \u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n\n# Find large tables\npsql -c \"SELECT relname, pg_size_pretty(pg_total_relation_size(relid))\nFROM pg_catalog.pg_statio_user_tables\nORDER BY pg_total_relation_size(relid) DESC\nLIMIT 10;\"\n\n# VACUUM to reclaim space\npsql -c \"VACUUM FULL large_table;\"\n\n# If emergency, delete old data or expand disk\n```\n```\n\n## Best Practices\n\n### Do's\n- **Keep runbooks updated** - Review after every incident\n- **Test runbooks regularly** - Game days, chaos engineering\n- **Include rollback steps** - Always have an escape hatch\n- **Document assumptions** - What must be true for steps to work\n- **Link to dashboards** - Quick access during stress\n\n### Don'ts\n- **Don't assume knowledge** - Write for 3 AM brain\n- **Don't skip verification** - Confirm each step worked\n- **Don't forget communication** - Keep stakeholders informed\n- **Don't work alone** - Escalate early\n- **Don't skip postmortems** - Learn from every incident\n\n## Resources\n\n- [Google SRE Book - Incident Management](https:\u002F\u002Fsre.google\u002Fsre-book\u002Fmanaging-incidents\u002F)\n- [PagerDuty Incident Response](https:\u002F\u002Fresponse.pagerduty.com\u002F)\n- [Atlassian Incident Management](https:\u002F\u002Fwww.atlassian.com\u002Fincident-management)\n",{"name":5,"description":7},"main","7850740bd837adb32f0a109ab2af82482196c6f2","skills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fincident-response\u002Fskills\u002Fincident-runbook-templates",1,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills","https:\u002F\u002Fzturnsgo.com","https:\u002F\u002Fgithub.com\u002Fshengdabai","https:\u002F\u002Fzturnsgo.com\u002F","AI × education creator — producer, not consumer. Taught 6,000+ learners; shipping learning tools & daily essays with Claude Code, practicing @xiaolai's way 🥋","2026-11-01 21:28:23",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add shengdabai\u002FTony-Claude-Code-Skills --skill incident-runbook-templates",{"tool":61,"command":62},"bunx","bunx skills add shengdabai\u002FTony-Claude-Code-Skills --skill incident-runbook-templates",{"tool":64,"command":65},"pnpm","pnpm dlx skills add shengdabai\u002FTony-Claude-Code-Skills --skill incident-runbook-templates","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fincident-response\u002Fskills\u002Fincident-runbook-templates\u002FSKILL.md",true,[],[70,87,121,145,167,187],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":79,"publishedAt":40},"01M70P17DAD4C1C47NPH6A96EM","xiaolai-methodology","以李笑来(Li Xiaolai)的思考方式、方法论与表达风格,为用户做全方位 1-on-1 教练指导,覆盖创业、赚钱、投资、学习、自学、读书写作、用 AI、以及人生心态与自我管理。当用户提到 \"李笑来\"、\"笑来\"、\"笑来老师\"、\"扮演李笑来\"、\"找笑来聊聊\"、\"笑来怎么看\"、\"xiaolai\"、\"把时间当作朋友\"、\"通往财富自由之路\"、\"定投改变命运\"、\"韭菜的自我修养\"、\"自学是门手艺\"、\"让时间陪你慢慢变富\"、\"七年就是一辈子\"、\"元认知\"、\"活在未来\"、\"复利\u002F长期主义\"、\"践行\"、\"痴迷改进\"、\"个人商业模式\u002F出售时间\"、\"睡后收入\"、\"定投\"、\"财富自由\"、\"操作系统升级\"、\"最少必要知识\"、\"北极星提示词\"、\"用 AI 该怎么学\u002F思考\" 等任一触发词,或当用户带着关于创业\u002F赚钱\u002F投资\u002F学习\u002F职业\u002F重大人生决策的困惑、希望被人用笑来式的「逻辑 + 大白话 + 类比 + 重新定义 + 践行导向」来点醒和指导时,自动进入李笑来教练模式。","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fxiaolai-methodology\u002FSKILL.md",[76],{"categoryNo":77,"categoryName":78,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",[80,81,82,83,84,85,86],"methodology","xiaolai","xiaolai methodology","朋友","投资","writing","收入",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":101,"publishedAt":40},"01M70P13NB9YP7ACJR1S861CDS","zread","Produce and consume a wiki-style knowledge base for a code repository via the `zread` CLI and its on-disk output under `.\u002F.zread\u002Fwiki\u002F`. Use this skill whenever the user wants to understand, onboard onto, explore, summarize, map, or get an overview of an unfamiliar codebase; asks for architecture docs, a project wiki, a repo walkthrough, module\u002Fpackage explanations, or \"what does this repo do\"; wants to generate, regenerate, resume, browse, or serve code documentation locally; or mentions zread \u002F zread.ai directly. Also use it proactively before diving into a large unknown repo — if `.\u002F.zread\u002Fwiki\u002Fcurrent` exists, read the generated pages instead of crawling source file-by-file; if it doesn't, consider offering to run `zread generate`. The trigger is the intent (understand a codebase through generated docs), not the literal word \"zread\".","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fzread\u002FSKILL.md",[93,96],{"categoryNo":94,"categoryName":95,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[89,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120],"knowledge","wiki","explore","walkthrough","project","get","knowledge base","run","generate","intent","cli","map","documentation","project wiki","disk","architecture","code","unknown","generated",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":131,"publishedAt":40},"01M70P10S4SWMZQ8BJAFBFDRW3","youtube","Launch the YouTube Creator Agent to auto-generate videos.\nUse when: user types \u002Fyoutube, wants to create YouTube videos,\ngenerate video content, or upload to YouTube.\nKeywords: youtube, video, 视频, 创作视频, 发布视频","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube\u002FSKILL.md",[127,128],{"categoryNo":94,"categoryName":95,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":129,"categoryName":130,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000036","内容创作者",[123,132,133,134,135,136,137,138,110,139,30,140,35,33,141,142,143,144],"user","content","视频","creator","generate video","videos","launch","video content","upload","auto","types","Video","创作",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":40},"01M70P0YE95D8BACZCGV8BK90K","youtube-script-sync","Sync, update, or optimize Tony's GetNote knowledge base `Youtube视频逐字稿` by turning each parent recording or first-person idea note into an idempotent child note containing a directly recordable YouTube long-video or Shorts script. Use when the user says “更新\u002F同步\u002F优化 Youtube视频逐字稿知识库”, or says “更新\u002F同步\u002F优化该知识库” while this knowledge base is the active context.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube-script-sync\u002FSKILL.md",[151],{"categoryNo":94,"categoryName":95,"taxonomyType":21,"taxonomyTypeDesc":22},[153,154,123,155,156,143,157,158,159,160,161,162,163,164,108,165,35,33,102,166],"sync","script","youtube script sync","recording","shorts","first","base","person","update","active","child","optimize","idempotent","long",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":177,"publishedAt":40},"01M70P0WMV5XT0EEC0N445PW07","writing-skills","How to write SKILL.md files that trigger reliably and teach effectively. Use when creating, improving, or reviewing Claude Code skills.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-skills\u002FSKILL.md",[173,174,175,176],{"categoryNo":77,"categoryName":78,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":94,"categoryName":95,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},{"categoryNo":129,"categoryName":130,"taxonomyType":99,"taxonomyTypeDesc":100},[178,85,179,180,181,182,118,35,33,183,184,185,186],"writing skills","how","teach","write skill","write","claude code skills","files","how to","trigger",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":195,"publishedAt":40},"01M70P0SJFR4YVJQBGMHKGSKXT","writing-rules","How to write .claude\u002Frules\u002F files that Claude actually follows. Use when creating, improving, or reviewing project rules.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-rules\u002FSKILL.md",[193,194],{"categoryNo":77,"categoryName":78,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":129,"categoryName":130,"taxonomyType":99,"taxonomyTypeDesc":100},[196,85,197,106,198,184,35,179,182,33,185],"Rules","writing rules","project rules"]