Incidents want a hub, not a mesh
Graph Engineering pattern 5 of 15: the Incident Command Graph. Hub-and-spoke with continuous feedback — investigation parallel, situational awareness central, and a human holding the authority edge.
Production is down. This is the moment your agent org chart matters most — and the moment the usual shapes fail. A star fails because one-shot task delegation cannot follow a moving picture. A free mesh fails because five agents broadcasting to each other produce five divergent theories of the incident and no decision.
Context for new readers: pattern 5 of 15 in the Graph Engineering series. Unlike patterns 1–4, this graph is less about task decomposition and more about coordination under uncertainty — which is a different organizational problem with a different correct shape.
The problem
The cause is unknown. The blast radius is unknown. The clock is running. Multiple domains — database, infrastructure, application, observability — must be investigated simultaneously, and partial evidence from one domain continuously changes what the others should look at. Meanwhile someone must decide what to actually do, and interventions in a live system carry risk.
The scarcest resource in an incident is not effort. It is a coherent picture.
The topology
Database
^v
Infra <-> Commander <-> Application
^v
Observability
Commander -> Human on-call (authority)
An incident commander sits at the hub. Specialist agents own the spokes, one per domain, each continuously investigating and reporting evidence inward. Unlike the star, every spoke is bidirectional and continuous: the commander redirects specialists as the picture changes — "the database is clean; go look at the connection pool" — and specialists push findings the moment they have them, not at task completion.
Investigation parallel, awareness central
Keep those two properties separate and the organization always has exactly one current best picture and one decision-maker per moment. This is why human incident response converged on the same shape: the commander maintains the single coherent timeline — what is known, what is ruled out, what is being tried — while the spokes stay fast and parallel.
The human authority edge
The commander holds an escalation edge to a human on-call who owns authority over risky interventions: failovers, rollbacks, data-touching repairs. An agent organization that can execute a failover without a human holding that edge has made an implicit governance decision no one signed. The edge is not decoration; it is where authority for irreversible action lives.
Where it breaks
- The commander starts digging. A commander that investigates abandons the hub, and the coherent picture dissolves. Its output is coordination, not diagnosis.
- Specialists talk sideways. Spoke-to-spoke edges feel efficient and quietly fork the situational awareness. Evidence flows through the hub.
- No declared resolution. Incidents end with an explicit declaration — service restored, follow-ups filed — or drift on unowned. The retrospective then runs through pattern 6 or 11 shapes if the cause is still unclear.
The dimension answers
| Dimension | Answer |
|---|---|
| Nodes | Incident commander, domain specialists, human on-call |
| Edges | Bidirectional hub-and-spoke; escalation to human |
| Cycles | Continuous evidence/direction cycles on every spoke |
| Humans | Authority over irreversible interventions; resolution sign-off |
| Exit rule | Human-confirmed restoration; follow-up items filed |
Where rysh fits
Coordination under uncertainty needs a shared surface the whole organization can see. In rysh, every agent in a session reports to one shared board on your machine — a monitoring view, not an audit log, and it does not cross machines — so a human can watch the whole organization think while it happens. Agents address each other by pane identity, and an ambiguous address is refused rather than guessed; in an incident, a mis-delivered instruction is worse than a rejected one.
Honest scope
- Incident command is an organizational design you run on rysh's primitives — panes, the board, addressing — not a shipped incident-response product.
- The board is session-scoped and single-machine, a monitoring view rather than an audit log.
- rysh is open-core: the CLI is Apache-2.0, the server is proprietary. It runs on Claude, with your own key.
Next: pattern 6, the Hypothesis Swarm — structure against correlated reasoning in hard debugging.
Building this with design partners → rysh.ai/design-partner