kf incident

Open, triage, escalate, acknowledge, and resolve incidents.

kf incident acknowledge

Mark a firing or triaging Incident as acknowledged_no_op.

Mark a firing or triaging Incident as acknowledged_no_op. Used when the Signal is informational, the operator has read it, and no autofix or escalation is appropriate.

Example

kf incident acknowledge --tenant tnt_demo --actor-type USER --actor-id usr_sam --incident-id <value> --expected-version <value> --acknowledged-by <value> --reason <value>

kf incident escalate

Escalate an Incident to a human owner from firing, triaging, or proposed.

Escalate an Incident to a human owner from firing, triaging, or proposed. Records the reason and stamps escalated_on; the autofix loop stops here until an operator resolves or acknowledges.

Example

kf incident escalate --tenant tnt_demo --actor-type USER --actor-id usr_sam --incident-id <value> --expected-version <value> --reason <value>

kf incident execute-action

Execute the ProposedAction for an Incident in proposed.

Execute the ProposedAction for an Incident in proposed. Records resolved_command_receipt_id, transitions through executing to resolved atomically, and emits both incidents.action_executed and incidents.resolved in the same transaction. DENY proposals cannot execute; R3 and R4 proposals require a bound APPROVED approval request.

Example

kf incident execute-action --tenant tnt_demo --actor-type USER --actor-id usr_sam --incident-id <value> --expected-version <value> --resolved-command-receipt-id <value>

kf incident open

Open an Incident, or join an existing open one when the (tenantId, environmentId, fingerprint) tuple already has a row not in resolved or acknowledged_no_op.

Open an Incident, or join an existing open one when the (tenantId, environmentId, fingerprint) tuple already has a row not in resolved or acknowledged_no_op. Idempotent on metadata.idempotencyKey. Back-fills signals.incident_id when a new Signal joins an existing Incident. Drives the Signal Plane state machine; see implementation notes

Example

kf incident open --tenant tnt_demo --actor-type USER --actor-id usr_sam --signal-id <value> --fingerprint <value> --severity <value> --fault-class <value> --surface <value> --code <value> --opened-on <value>

kf incident propose-action

Attach a ProposedAction to an Incident in triaging.

Attach a ProposedAction to an Incident in triaging. Stores the canonical ProposedAction shape from implementation source: commandType, input, dryRunPreview, riskClass (R0..R4), policyDecision (ALLOW | REQUIRES_APPROVAL | DENY), rationale, modelId, evalScore. Transitions to proposed.

Example

kf incident propose-action --tenant tnt_demo --actor-type USER --actor-id usr_sam --incident-id <value> --expected-version <value> --proposed-action-id <value> --command-type <value> --input <value> --dry-run-preview <value> --risk-class <value> --policy-decision <value> --rationale <value> --model-id <value> --eval-score <value>

kf incident resolve

Resolve an Incident from any non-terminal state with a free-form reason.

Resolve an Incident from any non-terminal state with a free-form reason. Used for manual close-outs and for the auto-resolve path when the underlying Signal has stopped firing for a sustained window.

Example

kf incident resolve --tenant tnt_demo --actor-type USER --actor-id usr_sam --incident-id <value> --expected-version <value> --reason <value>

kf incident triage

Transition an Incident from firing to triaging and assign a triage skill name.

Transition an Incident from firing to triaging and assign a triage skill name. Version-checked; raises VersionConflictError on stale expectedVersion and InvalidStateError if the Incident is not in firing.

Example

kf incident triage --tenant tnt_demo --actor-type USER --actor-id usr_sam --incident-id <value> --expected-version <value> --assigned-skill <value>