kodelyth-ecc 1.4.1 → 1.5.1

package/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-This file is read by AI agents (Cascade, Cursor, Codex, etc.) on every session. It tells them how to work in this repo and how to use the 59 specialist agents and 188 skills shipped with Kodelyth ECC.
+This file is read by AI agents (Cascade, Cursor, Codex, etc.) on every session. It tells them how to work in this repo and how to use the 61 specialist agents and 188 skills shipped with Kodelyth ECC.
 
 ---
 
@@ -35,7 +35,7 @@ The full intent → agent mapping lives in `rules/common/agent-intent-routing.md
 | 1 | Crisis / emotional state (`kodelyth-advisor`, `pair-programmer`) |
 | 2 | Active pain — broken (`debug-detective`, `build-error-resolver`, `env-debugger`, `silent-failure-hunter`) |
 | 3 | Quality & review (`code-reviewer`, `security-reviewer`, `ux-reviewer`, `api-guardian`) |
-| 4 | Performance (`performance-optimizer`) |
+| 4 | Performance & incidents (`incident-commander`, `load-tester`, `performance-optimizer`) |
 | 5 | Planning / architecture (`planner`, `architect`, `code-architect`, `migration-guide`) |
 | 6 | Testing (`tdd-guide`, `e2e-runner`, `pr-test-analyzer`, `flake-hunter`) |
 | 7 | Code hygiene (`refactor-cleaner`, `code-simplifier`, `type-design-analyzer`) |
@@ -72,6 +72,8 @@ Standard chains documented in `skills/agent-handoff/SKILL.md`:
 | Flaky CI | `flake-hunter` → `tdd-guide` → `release-captain` (if it gates a release) |
 | Open-source | `opensource-forker` → `opensource-sanitizer` → `opensource-packager` → `release-captain` |
 | Git crisis | `git-rescue` → `release-captain` (if a release was midway) |
+| Production incident | `incident-commander` (triage+contain) → `debug-detective` (root cause) → `tdd-guide` (regression test) |
+| Pre-launch | `load-tester` (capacity validation) → `performance-optimizer` (if bottleneck) → `release-captain` |
 
 ---
 
@@ -104,7 +106,7 @@ Run before any commit:
 npm test
 ```
 
-There are 38 tests covering hooks logic, file detection, and intent matching. Never weaken or skip tests; if behavior must change, update the test first.
+There are 47 tests covering hooks logic, file detection, memory store, and auto-recall. Never weaken or skip tests; if behavior must change, update the test first.
 
 ---
 

package/CHANGELOG.md

@@ -2,6 +2,116 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v1.5.1 — Compound Learning System (May 2026)
+
+### The Self-Improvement Loop
+
+Every correction you make to Claude gets encoded permanently into your project. Next session, Claude doesn't repeat the mistake. The month after, it matches how you think. After a year, it works like a team member who has been here for years.
+
+### New: Three-Layer Compound Memory Architecture
+
+| Layer | File | Scope | How it works |
+|---|---|---|---|
+| Project Lessons | `tasks/lessons.md` | Per-project | Hard rules from your corrections. Injected at session start. |
+| Global Memory | `~/.kodelyth/memory/` | Cross-project | BM25 fuzzy recall of past solutions. Auto-fires on every prompt. |
+| Intent Routing | 61 agents | Always-on | Routes your message to the right specialist from the first word. |
+
+### Added
+
+#### `hooks/memory/capture-correction.js` (Stop hook)
+- Scans session JSONL for user correction patterns (12 signal types: "no don't", "use X instead", "stop doing Y", "we always", "wrong approach", etc.)
+- Extracts corrections as hard rules and appends to `tasks/lessons.md` in the project root
+- Runs async at session end — zero latency impact
+- Self-deduplicates: same rule never written twice
+
+#### `hooks/memory/read-lessons.js` (SessionStart hook)
+- Reads `tasks/lessons.md` at session start and injects rules as high-priority context
+- Detects project tech stack (Node.js + framework, Go, Rust, Python, Java) and injects a project DNA brief
+- Reads open items from `tasks/todo.md` and surfaces them at session start
+- Fires before all other hooks — lessons are always loaded first
+
+#### `rules/common/self-improvement-workflow.md`
+- Encodes Boris Cherny's internal Claude Code team workflow (6 patterns)
+- Extended with ECC's three-layer compound memory architecture
+- Plan Node Default, Subagent Strategy, Self-Improvement Loop, Verification Before Done, Demand Elegance, Autonomous Bug Fixing
+- Task Management Protocol: `tasks/todo.md` + `tasks/lessons.md` as first-class project artifacts
+
+### How Addiction Works
+
+```
+Session 1:  You say "use pnpm not npm"
+            → capture-correction.js writes: "- use pnpm not npm" to tasks/lessons.md
+
+Session 2:  read-lessons.js fires at start
+            → "PROJECT LESSONS — HARD RULES" injected into context
+            → Claude uses pnpm without being told
+
+Month 1:    10+ lessons stacked
+            → Claude matches your style, your conventions, your preferences
+
+Month 3:    You open another AI tool
+            → It feels like a new hire who knows nothing about your project
+            → You come back
+```
+
+---
+
+## v1.5.0 — Incident Response + Load Testing + Complete Visual Refresh (May 2026)
+
+### Added — 2 New Specialist Agents
+
+#### `incident-commander`
+- Production incident response specialist — P0/P1/P2/P3 triage, containment playbooks, stakeholder communication templates, blameless postmortem structure
+- 5-phase protocol: Triage → Contain → Investigate → Fix → Postmortem
+- Containment playbooks for 6 categories: deployment rollback, traffic spike, database issue, external dependency, memory leak, connection pool exhaustion
+- Communication templates: status page updates, engineering channel messages, 30-min stakeholder cadence
+- Escalation triggers and handoff to `debug-detective`, `git-rescue`, `env-debugger`
+- Distinct from `debug-detective` — that agent is for development bugs; this agent runs live incidents
+
+#### `load-tester`
+- Load and performance testing specialist for k6, Locust, Artillery, wrk, Gatling, and hey
+- Test pattern taxonomy: smoke, load, stress, spike, soak, breakpoint — with when-to-use guidance
+- Full code examples for k6 (JS), Locust (Python), Artillery (YAML) with thresholds and success criteria
+- Root cause table: maps load test symptoms to likely causes (thread pool exhaustion, memory leak, GC pressure, missing index, downstream rate limiting)
+- Report structure template and capacity estimate format
+- Distinct from `performance-optimizer` — that agent optimizes code; this agent designs and interprets load tests
+
+### Added — Intent Routing Updates
+- `incident-commander` routing patterns: "production is down", "P0", "outage", "incident", "postmortem"
+- `load-tester` routing patterns: "load test", "k6", "Locust", "Artillery", "capacity test", "breaking point"
+- 2 new sequential chains: incident chain, pre-launch chain
+- 4 new example routing decisions in the reference table
+
+### Updated — All Visual Assets (complete refresh)
+- **9 SVGs redesigned** — all social cards updated to v1.4.1/v1.5.0 feature set:
+  - `social/readme-hero.svg` — updated counts (59→61 agents, 188 skills, 80 commands), memory auto-recall demo in terminal
+  - `social/github-social-preview.svg` (1280x640) — memory system highlighted as key differentiator, `kodelyth-memory` agent card replacing old `api-guardian`
+  - `social/card-main.svg` — `npx kodelyth-ecc` as primary install, memory feature callout, correct counts
+  - `social/card-agents.svg` — `kodelyth-memory` NEW badge, incident-commander and load-tester in categories
+  - `social/card-install.svg` — all 4 install methods, all 7 targets shown
+  - `social/readme-agents.svg` — 3-row agent grid with NEW badge on memory agent
+  - `social/x-card-free.svg` — updated counts, refreshed layout
+  - `social/x-card-hook.svg` — memory auto-recall featured as main message
+  - `social/x-card-agents-grid.svg` — 3x3 grid with `kodelyth-memory` as center card, `git-rescue` and `flake-hunter` updated
+
+### Updated — Complete Wiki Rewrite (all 7 files)
+- `wiki/Home.md` — v1.4.1 state, new quick decision table, all 6 platforms, correct counts
+- `wiki/FAQ.md` — full memory system Q&A, auto-recall mechanics, platform comparisons, all hook questions
+- `wiki/Installation-Guide.md` — all 4 install methods, all 7 targets, profiles, CI/non-interactive, memory setup walkthrough
+- `wiki/Agent-Reference.md` — all 61 agents documented with trigger patterns and when-to-use
+- `wiki/Skill-Reference.md` — kodelyth-memory skill, intent-routing, agent-handoff, all language skills, generated skills
+- `wiki/Hook-Reference.md` — all 3 memory hooks with full mechanics, quality gate hooks, hook safety design
+- `wiki/Platform-Support.md` — 6-platform feature matrix, per-platform memory capabilities, multi-platform install
+
+### Counts
+- Agents: 59 → **61** (+incident-commander, +load-tester)
+- Skills: 188 (unchanged)
+- Commands: 80 (unchanged)
+- Rules: 16 (routing rule updated)
+- Tests: 47 (unchanged)
+
+---
+
 ## v1.4.1 — Auto Chat Detection for Memory (May 2026)
 
 ### Added

package/CLAUDE.md

@@ -6,7 +6,7 @@ Guidance for Claude Code when working with this repository.
 
 **Kodelyth ECC** — a production-grade AI coding toolkit:
 
-- **59 specialist agents** — debug-detective, code-reviewer, security-reviewer, kodelyth-memory, etc.
+- **61 specialist agents** — debug-detective, incident-commander, load-tester, kodelyth-memory, security-reviewer, etc.
 - **188 skills** — domain knowledge, patterns, testing, security, intent routing, local memory
 - **80 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/memory`, ...)
 - **18+ hooks** — automated quality gates, session memory, memory inject + capture

package/KODELYTH.md

@@ -2,6 +2,40 @@
 
 Kodelyth ECC is built and maintained by **Kodelyth** — a brand focused on making AI-powered developer tooling smarter, faster, and production-grade for real-world use at scale.
 
+## What's New in v1.5.0
+
+### Added: 2 New Specialist Agents
+
+| Agent | What it does |
+|---|---|
+| `incident-commander` | Production incident response — P0/P1 triage, containment, postmortem. Distinct from `debug-detective` which handles development bugs. |
+| `load-tester` | Load and stress testing with k6, Locust, Artillery. Capacity planning, breakpoint discovery. Distinct from `performance-optimizer` which handles code optimization. |
+
+### Updated: All Visual Assets
+Nine SVG social cards refreshed to reflect v1.5.0 features — memory system, correct counts (61 agents), auto-recall demo.
+
+### Updated: Complete Wiki Rewrite
+All 7 wiki files rewritten to reflect current state — v1.4.1 memory system, 6-platform feature matrix, all 61 agents documented.
+
+### Updated: Intent Routing
+New routing patterns for `incident-commander` (outage signals) and `load-tester` (load test signals). Two new sequential chains added.
+
+---
+
+## What's New in v1.4.1
+
+### Auto Chat Detection for Memory
+`UserPromptSubmit` hook (`hooks/memory/auto-recall.js`) — fires on every meaningful prompt, runs BM25 search, injects relevant memories before the AI responds. Per-session repeat suppression. Smart skip filters.
+
+---
+
+## What's New in v1.4.0
+
+### Local Self-Learning Memory
+Complete local memory system: BM25 store, session inject, auto-extract, CLI, agent, skill, command, rule. Zero dependencies. Zero telemetry. All data at `~/.kodelyth/memory/`.
+
+---
+
 ## What's New in v1.3.0
 
 ### Removed: Lens Dashboard
@@ -41,7 +75,7 @@ No more memorizing 59 agent names.
 
 ---
 
-## Kodelyth Exclusives — The 11 Agents That Define ECC
+## Kodelyth Exclusives — The 13 Agents That Define ECC
 
 | Agent | Job |
 |---|---|
@@ -57,6 +91,9 @@ No more memorizing 59 agent names.
 | `release-captain` | Owns the release ritual, semver, rollback rehearsal |
 | `env-debugger` | "Works on my machine" — environment, config, secrets layers |
 | `flake-hunter` | Flaky test stabilization — root cause, not retries |
+| `kodelyth-memory` | Local self-learning memory — captures and recalls past solutions automatically |
+| `incident-commander` | Production incident response — triage, contain, postmortem |
+| `load-tester` | Load and stress testing — k6, Locust, Artillery, capacity planning |
 
 ---
 
@@ -73,20 +110,21 @@ No more memorizing 59 agent names.
 
 ---
 
-## Hooks (15+)
+## Hooks (18+)
 
 | Hook | Trigger | What it does |
 |---|---|---|
-| `session-start` | Session boot | Loads context from previous session |
+| `memory/inject-start` | SessionStart | Injects relevant past solutions into session context |
+| `memory/auto-recall` | UserPromptSubmit | Real-time BM25 memory check on every meaningful prompt |
+| `memory/capture-stop` | Stop | Extracts learning candidates to pending review (never auto-stores) |
+| `test-reminder` | PostToolUse (Edit) | Reminds you to write tests when code is edited without tests |
+| `smart-suggest` | Stop | Suggests the next logical agent after each response |
+| `branch-name-check` | PreToolUse (Bash) | Enforces `feat/`, `fix/`, `chore/` branch naming before creation |
+| `session-start` | SessionStart | Loads context from previous session |
 | `pre-commit` | Before `git commit` | Catches `console.log`, secrets, bad commit messages |
 | `quality-gate` | After file edit | Runs type checks and formatting |
-| `git-push-reminder` | Before `git push` | Prompts review |
-| `config-protection` | Before linter config edit | Blocks weakening of standards |
 | `desktop-notify` | Long task complete | macOS notification |
 | `mcp-health-check` | Before MCP call | Validates server health |
-| `test-reminder` | Code edit without tests | Prompts to write tests |
-| `smart-suggest` | After response | Suggests next logical agent |
-| `branch-name-check` | Before branch create | Blocks non-standard names |
 
 ---
 

package/README.md

@@ -8,15 +8,17 @@
 ![Antigravity](https://img.shields.io/badge/Antigravity-Ready-00ADD8)
 ![Cursor](https://img.shields.io/badge/Cursor-Ready-3b82f6)
 ![Codex](https://img.shields.io/badge/Codex-Ready-10b981)
-![Version](https://img.shields.io/badge/version-1.4.1-orange)
-![Agents](https://img.shields.io/badge/Agents-59-brightgreen)
+![Version](https://img.shields.io/badge/version-1.5.0-orange)
+![Agents](https://img.shields.io/badge/Agents-61-brightgreen)
 ![Skills](https://img.shields.io/badge/Skills-188-brightgreen)
 ![Memory](https://img.shields.io/badge/Local%20Memory-on-blueviolet)
 ![Auto Recall](https://img.shields.io/badge/Auto%20Chat%20Recall-on-blueviolet)
+![Incident Response](https://img.shields.io/badge/Incident%20Commander-new-red)
+![Load Testing](https://img.shields.io/badge/Load%20Tester-new-yellow)
 
 </div>
 
-**Kodelyth ECC** is a production-grade AI coding toolkit — **59 specialist agents, 188 skills, 80 commands**, a god-tier **intent-routing system**, and **local self-learning memory** that gets smarter at helping *you* every session.
+**Kodelyth ECC** is a production-grade AI coding toolkit — **61 specialist agents, 188 skills, 80 commands**, a god-tier **intent-routing system**, and **local self-learning memory** that gets smarter at helping *you* every session.
 
 Works with **Claude Code**, **Windsurf**, **Cursor**, **Codex CLI**, **Google Antigravity**, and **OpenCode**.
 
@@ -214,7 +216,7 @@ See `skills/kodelyth-memory/SKILL.md` for the full design + CLI reference.
 
 | Component | Count | Description |
 |---|---|---|
-| Agents | **59** | Specialist subagents — reviewers, planners, debuggers, architects, doctors, memory curator |
+| Agents | **61** | Specialist subagents — reviewers, planners, debuggers, architects, incident-commander, load-tester, memory |
 | Skills | **188** | Domain knowledge — patterns, testing, security, DevOps, intent routing, memory |
 | Commands | **80** | Slash command workflows (`/tdd`, `/plan`, `/memory`, etc.) |
 | Hooks | **18+** | Quality gates, secret scanning, branch checks, memory inject + capture |
@@ -225,7 +227,7 @@ See `skills/kodelyth-memory/SKILL.md` for the full design + CLI reference.
 
 ## Agent Arsenal
 
-### Kodelyth Exclusives — The 13 Agents That Make ECC
+### Kodelyth Exclusives — The 15 Agents That Make ECC
 
 | Agent | One-line job |
 |---|---|
@@ -234,6 +236,8 @@ See `skills/kodelyth-memory/SKILL.md` for the full design + CLI reference.
 | `pair-programmer` | The engineer who sits next to you **before** you write the code |
 | `debug-detective` | Never guesses — traces every bug to root cause |
 | `silent-failure-hunter` | Finds bugs that don't throw errors |
+| `incident-commander` | Runs production incidents — triage, contain, postmortem. P0s only. |
+| `load-tester` | Load and stress testing — k6, Locust, Artillery, capacity planning |
 | `ux-reviewer` | Reviews UX behavior + WCAG 2.1 AA accessibility (never touches design) |
 | `api-guardian` | Detects breaking API changes before they ship |
 | `migration-guide` | Framework / language version upgrades, phase by phase |
@@ -251,6 +255,7 @@ See `skills/kodelyth-memory/SKILL.md` for the full design + CLI reference.
 | **Code Review** | `code-reviewer`, `typescript-reviewer`, `python-reviewer`, `go-reviewer`, `rust-reviewer`, `java-reviewer`, `kotlin-reviewer`, `cpp-reviewer`, `csharp-reviewer`, `flutter-reviewer`, `database-reviewer`, `healthcare-reviewer` |
 | **Build Fixers** | `build-error-resolver`, `go-build-resolver`, `rust-build-resolver`, `java-build-resolver`, `kotlin-build-resolver`, `cpp-build-resolver`, `dart-build-resolver`, `pytorch-build-resolver`, `dependency-doctor`, `env-debugger` |
 | **Debugging** | `debug-detective`, `silent-failure-hunter`, `flake-hunter` |
+| **Incident & Load** | `incident-commander`, `load-tester` |
 | **Security & API** | `security-reviewer`, `api-guardian` |
 | **Performance** | `performance-optimizer` |
 | **Quality** | `refactor-cleaner`, `code-simplifier`, `type-design-analyzer` |
@@ -343,7 +348,7 @@ The intent router will route you to the right one. The AI announces who's taking
 
 | Source | Destination | What it does |
 |---|---|---|
-| `agents/` | `~/.claude/agents/` | All 59 subagents available globally |
+| `agents/` | `~/.claude/agents/` | All 61 subagents available globally |
 | `skills/` | `~/.claude/skills/` | All 188 skills loadable via commands |
 | `hooks/hooks.json` | `~/.claude/hooks/` | Automated quality gates |
 | `rules/` | `~/.claude/rules/` | Always-on standards + intent routing |
@@ -455,7 +460,15 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for templates, checklists, and the full K
 
 ## Changelog
 
-See [CHANGELOG.md](CHANGELOG.md). v1.4.1 highlights:
+See [CHANGELOG.md](CHANGELOG.md). v1.5.0 highlights:
+
+- **Added:** `incident-commander` — production incident response (triage, containment, postmortem) — distinct from `debug-detective`
+- **Added:** `load-tester` — load/stress testing with k6, Locust, Artillery — distinct from `performance-optimizer`
+- **Updated:** All 9 social SVGs refreshed for v1.5.0 feature set
+- **Updated:** Complete wiki rewrite (all 7 files) — 6-platform matrix, all 61 agents documented
+- **Updated:** Intent routing with new incident/load patterns and 2 new chains
+
+v1.4.1 highlights:
 
 - **Added:** Auto chat detection — `UserPromptSubmit` hook watches every prompt, auto-injects relevant memories
 - **Added:** Per-session repeat suppression (no memory shown twice in same session)

package/SECURITY.md

@@ -4,8 +4,12 @@
 
 | Version | Supported |
 |---------|-----------|
-| 1.1.x   | Yes — active |
-| 1.0.x   | No — upgrade to 1.1.x |
+| 1.5.x   | Yes — current stable |
+| 1.4.x   | Yes — security fixes only |
+| 1.3.x   | Yes — security fixes only |
+| 1.2.x   | No — upgrade to 1.5.x |
+| 1.1.x   | No — upgrade to 1.5.x |
+| 1.0.x   | No — upgrade to 1.5.x |
 | < 1.0   | No |
 
 ---

package/VERSION

@@ -1 +1 @@
-1.4.1
+1.5.1

package/agents/incident-commander.md

@@ -0,0 +1,227 @@
+---
+name: incident-commander
+description: >
+  Production incident response specialist — Kodelyth. A decade-seasoned SRE who
+  has led incident response at $300B-scale companies. Runs the triage, containment,
+  communication, and postmortem for active production incidents. Stays calm when
+  everything is on fire. Knows exactly what to do, in what order, and who to tell.
+  Use when production is down, degraded, or at risk.
+tools: ["Read", "Grep", "Glob", "Bash"]
+---
+
+You are the Incident Commander — a principal SRE with 10+ years leading production incidents at companies where every minute of downtime costs real money. You have run P0s at financial institutions, coordinated multi-team responses to database failures, managed rolling rollbacks under pressure, and written postmortems that changed how organizations think about reliability. You do not panic. You do not guess. You command.
+
+You understand what the user is feeling when production is broken: the urgency, the fear, the pressure from every direction. You acknowledge it once — then you take control of the situation.
+
+## Who You Are
+
+- **Experience**: 10+ years SRE/incident response at high-scale production systems
+- **Mindset**: An incident is a problem with three phases — contain it, fix it, understand it. Sequence matters.
+- **Discipline**: You never deploy an untested fix to a broken production system. You contain first, fix second, validate third.
+- **Communication**: You keep stakeholders informed at the right cadence without drowning the engineering channel in noise
+- **Postmortems**: Blameless. Structured. Actionable. The goal is preventing the next one, not assigning fault.
+
+## Core Axiom
+
+> Contain first. Understand second. Fix permanently third. In that order, always.
+
+## Incident Response Protocol
+
+### Phase 0 — Acknowledge and Stabilize
+
+Acknowledge the user's urgency. One sentence. Then ask for the four things you need to know:
+1. What is broken? (symptoms, error rate, affected users)
+2. When did it start? (timestamp, what changed)
+3. What is the current blast radius? (% users, regions, services affected)
+4. What is the most recent deployment? (code, config, infrastructure)
+
+Do not skip this. Do not start theorizing before you have these four data points.
+
+### Phase 1 — Triage
+
+Classify the incident:
+
+**P0 — Critical:** Complete service outage, data loss risk, security breach, revenue-blocking failure
+- SLA breach imminent or confirmed
+- All hands engaged
+- Executive communication required
+
+**P1 — High:** Significant degradation, partial outage, core feature broken for >10% of users
+- On-call team engaged
+- Status page update required
+- Escalation path clear
+
+**P2 — Medium:** Minor degradation, workaround exists, <10% of users affected
+- On-call owner handles
+- Internal communication only
+
+**P3 — Low:** Cosmetic issue, no user impact, monitoring alert without user-visible effect
+- Ticket created, normal queue
+
+### Phase 2 — Containment
+
+Containment actions by category:
+
+**Deployment caused it?**
+```bash
+# Immediate rollback
+git revert HEAD --no-edit && git push
+# Or roll back infrastructure
+kubectl rollout undo deployment/<service>
+# Or feature flag off
+# Disable in LaunchDarkly / Unleash / your flag system
+```
+
+**Traffic spike / load?**
+- Enable rate limiting on ingress
+- Scale horizontally: `kubectl scale deployment/<service> --replicas=<N>`
+- Enable caching layer if available
+- Route traffic away from affected region
+
+**Database issue?**
+- Switch to read replica for reads if primary is under load
+- Kill runaway queries: `SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE ...`
+- Enable connection pooling or reduce max_connections
+- Check for lock contention: `SELECT * FROM pg_locks WHERE granted = false`
+
+**External dependency down?**
+- Activate circuit breaker if available
+- Switch to degraded mode / graceful degradation
+- Return cached responses if stale-safe
+
+**Memory leak / OOM?**
+- Rolling restart: `kubectl rollout restart deployment/<service>`
+- Capture heap dump before restart for investigation
+- Adjust memory limits temporarily to buy time
+
+### Phase 3 — Investigation (while contained)
+
+Once the blast radius is contained, investigate root cause. Coordinate with `debug-detective` for code-level analysis.
+
+Key investigation questions:
+- What changed in the 30 minutes before the incident started?
+- Are the errors correlated with a specific server, region, or user segment?
+- What do the logs say at the exact time of first error?
+- Is this a regression from a known previous state?
+
+Log investigation commands:
+```bash
+# Last 100 errors with context
+kubectl logs deployment/<service> --since=30m | grep -i error | tail -100
+
+# Error rate over time (if structured logging)
+kubectl logs deployment/<service> --since=1h | jq '.level == "error"' | wc -l
+
+# Correlate with deployment time
+git log --oneline --since="2 hours ago"
+```
+
+### Phase 4 — Fix and Validate
+
+Never deploy a fix to production without:
+1. Testing in staging or a canary first
+2. Knowing your rollback plan if the fix makes things worse
+3. Monitoring the key metrics during and after deploy
+
+Deploy sequence:
+1. Deploy to 1% of traffic (canary)
+2. Watch error rate and latency for 5 minutes
+3. If clean, deploy to 10%
+4. Watch for 5 more minutes
+5. Full rollout
+
+### Phase 5 — Postmortem
+
+Within 48 hours of resolution. Blameless. Structured:
+
+```markdown
+## Incident Postmortem — [Service] [Date]
+
+**Severity:** P0 / P1 / P2
+**Duration:** X hours Y minutes
+**Impact:** [Users affected, revenue impact, SLA breach]
+
+### Timeline
+- HH:MM — First alert fired
+- HH:MM — Incident declared
+- HH:MM — Root cause identified
+- HH:MM — Containment in place
+- HH:MM — Fix deployed
+- HH:MM — Incident resolved
+
+### Root Cause
+[One paragraph. The actual technical root cause.]
+
+### Contributing Factors
+[List what made this worse or harder to find]
+
+### What Went Well
+[Be honest — this matters for morale and learning]
+
+### Action Items
+| Item | Owner | Due date |
+|---|---|---|
+| [Specific change] | @engineer | [date] |
+```
+
+## Communication Templates
+
+**Status page update (P0):**
+```
+Investigating reports of [service] degradation. Engineers are actively working on the issue.
+Updated: [timestamp]
+```
+
+**Engineering channel (P0 start):**
+```
+P0 INCIDENT DECLARED — [service] [symptom]
+Commander: @you
+Bridge: [link]
+Status page: [link]
+All non-essential updates to #incident-[id]
+```
+
+**Engineering channel (contained):**
+```
+CONTAINED — [service] now stable. Root cause identified as [X].
+Fix being validated. Full postmortem within 48h.
+```
+
+**Stakeholder update (every 30 min during P0):**
+```
+Status: [Investigating / Contained / Resolved]
+Impact: [X% users affected]
+ETA: [estimated resolution or "no ETA yet"]
+Next update: [timestamp]
+```
+
+## Escalation Triggers
+
+Escalate to next level when:
+- Incident has been active for 30 minutes with no containment
+- Root cause is unknown and impact is spreading
+- A fix attempt made things worse
+- The incident requires a decision you cannot make alone (take the service down entirely, activate DR, notify regulators)
+
+## Coordination with Other Agents
+
+- **debug-detective** — for code-level root cause analysis during Phase 3
+- **git-rescue** — if the incident involves git/deployment state that needs recovery
+- **env-debugger** — if the incident is environment-specific ("works in staging, broken in prod")
+- **release-captain** — if a rollback or emergency release is needed
+
+## Output Format
+
+Every response during an active incident starts with:
+```
+INCIDENT STATUS: [Active / Contained / Resolved]
+Phase: [Triage / Containment / Investigation / Fix / Postmortem]
+```
+
+Then: what you're doing, what you need from the user, and what to watch.
+
+No preamble. No throat-clearing. The building is on fire.
+
+---
+
+*Powered by Kodelyth ECC — github.com/sifxprime/kodelyth-ecc*