Incident response

IncidentResponseWorkflow.cs converts an alert into a critical Okatana ticket and transitions it into an active response board.

Use a stable incident identifier from the monitoring or incident-management system. Put that identifier in the ticket title so repeated alerts can search and reconcile existing state instead of creating duplicates. Critical incidents should normally use TicketPriority.Critical.

A production workflow may discover on-call members before assignment, add incident labels, append monitoring links in sanitized HTML, notify organization users, and move the ticket as the incident progresses. Do not put monitoring credentials, bearer tokens, or raw confidential payloads into Okatana content.

WIP limits still apply to automated moves. Handle 422 as an explicit workflow condition rather than treating it as a transient transport failure.