oncall-handoff

On-Call Handoff Skill

Produces a compact end-of-shift handoff the incoming on-call can read in under two minutes and act on for the next seven days. The single job: transfer state and attention, not a novel.

Working from a brief

Deliver the full handoff even from a thin brief — infer and label assumptions (never invent incident IDs, timestamps, service names, or dashboard URLs). If the outgoing engineer hasn't listed something, ask once, then move on with "unknown — confirm on takeover" placeholders.

Required Inputs

Ask for (if not already provided), else label as unknown:

• Rotation & window — which rotation, dates and timezone of the shift ending, and dates of the shift starting.
• Open incidents — for each: ticket ID, severity, one-line status, next step, owner.
• Silenced/flapping alerts — alert name, why silenced, when the silence expires.
• In-flight investigations — hypotheses not yet closed out, where the notes live.
• Recent risky changes — deploys, feature flag flips, config rollouts in the last ~72h that might still bite.
• Upcoming risky events — planned deploys, freezes, marketing pushes, load tests.
• Runbook or dashboard drift — anything you touched that the runbook doesn't reflect yet.

Output Format

# On-Call Handoff — <rotation>
**Outgoing:** <name>  ·  **Incoming:** <name>  ·  **Window handed over:** <YYYY-MM-DD HH:MM TZ → YYYY-MM-DD HH:MM TZ>

## TL;DR (read this if nothing else)
- <3–5 bullets: the state of the world, what's smoking, what's calm>

## 🔴 Open incidents
| ID | Sev | Service | Status (one line) | Next step | Owner |
|---|---|---|---|---|---|
| <INC-…> | <S1/S2/S3> | <svc> | <what's happening now> | <what to do next> | <person> |

## 🟡 Watchlist (silenced / flapping / near-threshold)
- **<alert name>** — silenced until <ts>. Reason: <one line>. If it fires after that, do <X>.

## 🔎 In-flight investigations (no incident yet)
- **<Hypothesis in one sentence>** — evidence so far in <link>. Next probe: <one line>.

## 🚀 Recent risky changes (last 72h)
- <deploy / flag / config> — <what shipped, blast radius, rollback command or link>.

## 📅 Upcoming this shift
- <planned deploy / freeze / launch / load test> — <when, who to page if it goes sideways>.

## 🧭 Runbook / dashboard drift
- <thing the runbook still says vs. what's actually true>. Owner to fix: <person>.

## Asks of the incoming on-call
1. <one thing to check within the first hour>
2. <one thing to confirm before end-of-week>

## Contacts
- Escalation: <person / group>. Vendor tickets in play: <list>. Slack channels to lurk: <#…>.

---
_Not an incident report — for full context on any open item, follow the linked ticket._

Quality Checks

• [ ] Every "open incident" row has a next step and an owner — a handoff without those is just a status page.
• [ ] Every silenced/flapping alert has an expiry or a condition for when it should stop being silenced — otherwise it will be silenced forever.
• [ ] Every "recent risky change" has a rollback path (command, PR revert link, or the person who knows how).
• [ ] Timestamps carry a timezone. "Tomorrow morning" is not a timestamp.
• [ ] TL;DR is readable standalone — the incoming on-call should be able to act on it before they finish coffee.
• [ ] No links or IDs are invented. Unknown values are marked "unknown — confirm on takeover", not fabricated.

Anti-Patterns

• [ ] Do not write a chronological journal of the outgoing shift. The incoming engineer doesn't need your Tuesday afternoon; they need the state at 09:00 today.
• [ ] Do not bury the buried lede. A P1 belongs in TL;DR, not on line 47.
• [ ] Do not hand off "everything is fine" without saying what "fine" means — name the top three services you actively looked at and their SLO status.
• [ ] Do not include war stories, praise, or vent. This is a working document, not a retro.
• [ ] Do not close out an investigation with "resolved itself" — either name the fix, or move it to the watchlist with a trigger for re-opening.
• [ ] Do not silently drop items from the previous handoff. If a previous open item is now closed, list it under a one-line "Closed since last handoff:" so the incoming engineer knows you saw it.

Example Trigger Phrases

• "Write an on-call handoff for this week"
• "Draft my SRE handover note"
• "Handoff pager to <name>"
• "End of shift summary"
• "Weekly on-call handover"