Incident response
Use this guide when production or operational work needs fast diagnosis with BMO in the loop — not for everyday feature development.
Set posture first
Section titled “Set posture first”- Switch Session modes to an SRE-appropriate mode if your pack defines one.
- Prefer read-only tools until you understand blast radius.
- Do not widen
--auto-approve-toolsduring an active incident unless policy explicitly allows it.
Inspect what happened
Section titled “Inspect what happened”| Step | Surface |
|---|---|
| Current session state | /run-observability, Run observability |
| Full timeline | /debugger, Agent debugger |
| Tool mutations on files | File tools telemetry |
| Cross-surface truth | Session observability parity |
Package evidence
Section titled “Package evidence”Use /incident or runtime incident tools to write a bounded diagnostic
capsule for handoff. The FAQ evidence table lists capsules vs debugger vs
journal — see FAQ — Evidence and recovery.
Recovery patterns
Section titled “Recovery patterns”- Branch-and-continue from checkpoint-backed debugger steps when you need to retry from a known-good point — see Agent debugger docs.
- Session compaction when context is full mid-incident — see Session compaction.
- TPM recovery when rate limits block progress — see TPM recovery.