Mobile Incident Basics

// docs/incident-severity.ts - copy into your runbook repo
export type IncidentSeverity = "SEV1" | "SEV2" | "SEV3" | "SEV4";
 
export type SeverityCriteria = {
  sev: IncidentSeverity;
  userImpact: string;
  revenuePath: boolean;
  example: string;
};
 
export const MOBILE_SEVERITY_MATRIX: SeverityCriteria[] = [
  {
    sev: "SEV1",
    userImpact: "App unusable for majority OR removed from store OR data breach",
    revenuePath: true,
    example: "Play suspension; auth down for all users on live build",
  },
  {
    sev: "SEV2",
    userImpact: "Critical path broken for >25% of active users",
    revenuePath: true,
    example: "Checkout crash on iOS 2.4.0 phased release",
  },
  {
    sev: "SEV3",
    userImpact: "Regression with workaround; partial rollout or single platform",
    revenuePath: false,
    example: "Settings tab crash on Android preview channel",
  },
  {
    sev: "SEV4",
    userImpact: "Internal-only, policy warning, or sub-threshold metric drift",
    revenuePath: false,
    example: "Sentry noise on dev profile; App Store metadata deadline",
  },
];

## Role assignment (paste into #incident-YYYYMMDD)
 
| Role | Owner | Responsibility |
|------|-------|----------------|
| **Incident Commander (IC)** | @oncall-mobile | Severity, timeline, go/no-go on rollback |
| **Tech Lead** | @mobile-lead | Triage, bisect, hotfix branch |
| **Comms** | @support-lead | Status page, support macros, social |
| **Scribe** | volunteer | Decision log with timestamps |
| **Store Ops** | @release-mgr | Pause phased release, Play halt - [Store Incident Response](../store-operations/store-incident-response.md) |

## Comms map
 
| Channel | Audience | Content rules |
|---------|----------|---------------|
| `#incident-YYYYMMDD` | Engineering + IC | Technical facts, commands run, hypotheses |
| `#incident-comms` | Support + PM + Comms | Approved customer-facing language only |
| PagerDuty / Opsgenie | On-call | Alert → acknowledge → join incident channel |
| Status page | Customers | No root cause until confirmed; no blame |
| Exec email | C-suite | Business impact, ETA range, what we are doing now |

# Internal (engineering) - OK
Suspect OTA group abc123 published 14:02 UTC. Crash-free dropped 99.4% → 96.1%.
Running eas channel:view production. IC: @jane.
 
# External (status page) - OK
We are investigating reports of ShopApp closing unexpectedly on some devices.
Next update in 30 minutes or sooner.
 
# External - NEVER
Caused by @bob's deploy. Rolling back now.

## T+0 to T+15 (mobile production)
 
- [ ] **Acknowledge** alert; IC assigned (single name in channel topic)
- [ ] **Confirm scope:** platform(s), build number, OTA update id, channel, % users
- [ ] **Correlate timing:** OTA publish, store rollout %, backend deploy, feature flag change
- [ ] **Contain blast radius:**
  - [ ] Pause iOS phased release / halt Play staged rollout
  - [ ] Flip remote kill switch for suspected surface
  - [ ] Start OTA rollback if JS bundle suspect - [OTA Emergency Rollback](./ota-emergency-rollback.md)
- [ ] **Open dashboards:** Sentry Release Health, payment success, auth errors, OTA apply rate
- [ ] **Notify** comms + exec if SEV1/SEV2
- [ ] **Do not** merge hotfix to main until IC confirms containment path

# Scope confirmation commands (run in parallel)
eas channel:view production
eas update:list --branch production --limit 3
# Sentry: filter by release + dist (OTA update id)

// Log at session start - support and incidents depend on this
import * as Application from "expo-application";
import * as Updates from "expo-updates";
 
export function getIncidentCorrelationTags() {
  return {
    nativeRelease: `${Application.nativeApplicationVersion}+${Application.nativeBuildVersion}`,
    otaUpdateId: Updates.updateId ?? "embedded",
    channel: Updates.channel ?? "none",
    runtimeVersion: Updates.runtimeVersion ?? "unknown",
  };
}

# OTA containment (JS regression)
eas update:rollback
eas channel:view production

## Status template (post every 15–30 min)
 
**SEV:** SEV2
**IC:** @jane
**Impact:** Checkout crash on iOS build 240012 (~18% phased users)
**Containment:** Phased release paused; flag `newCheckout` off
**Next:** Bisect OTA vs native - see Crash Spike Triage
**ETA:** Next update 15:45 UTC

## Exec / legal notification triggers
 
| Trigger | Notify |
|---------|--------|
| App removed from App Store or Play | Exec + Legal immediately (SEV1) |
| PII exposure or regulatory breach allegation | Legal immediately |
| Payment success down >5% abs for >15 min | Exec + Finance |
| Auth down >25% users | Exec |
| SEV3 optional feature crash | Engineering only |

## Same-day capture (scribe owns)
 
- [ ] Incident start/end UTC
- [ ] Final severity
- [ ] Affected releases: native builds + OTA ids
- [ ] Containment actions with timestamps
- [ ] Customer-visible duration
- [ ] Link to Sentry cluster / EAS update group
- [ ] Schedule post-mortem within 5 business days (SEV1/SEV2)