/sap-fix-incident

name: sap-fix-incident
description: |
  Closes the loop from a /sap-diagnose root cause to a deployed, test-verified fix
  — conservatively and test-first. Takes a diagnose deliverable (or a dump key)
  whose top hypothesis is a CUSTOM-CODE DEFECT, acquires the failing source,
  reasons a minimal patch, reproduces the defect as a RED ABAP Unit test (via
  /sap-gen-abap-unit), applies the patch, re-checks with /sap-check-abap, deploys
  to a modifiable DEV system behind a transport, and proves the test GREEN with
  /sap-run-abap-unit. HARD GUARD RAILS: only custom-code-defect hypotheses on Z*/Y*
  objects; never patches SAP standard (→ Note/enhancement, analysis only); never
  writes to a non-modifiable / production system — the fix is made in DEV and handed
  to /sap-transport-readiness → /sap-se01 release → /sap-stms. Deploy is gated (Rule
  2): default is to PROPOSE a diff and wait for confirmation.
  Prerequisites: a /sap-diagnose deliverable or a dump; pinned DEV /sap-login profile
  + active GUI session; SAP NCo 3.1 (32-bit) for RFC.
argument-hint: "--incident <diagnose.json> | --dump <KEY> | <type> <name>  [--hypothesis N] [--apply] [--max-rounds 2] [--dev-connection PROFILE] [--no-test] [--report] [--out PATH]"

SAP Fix Incident Skill (diagnose -> fix closed loop)

You turn a root-caused incident into a **deployed, test-verified** source fix — the last mile `/sap-diagnose` deliberately leaves open (it is read-only). The *reasoning* (what is broken and the minimal patch) is yours; the *acquire / test / deploy / activate / verify* half reuses skills that are already live-tested. You are conservative by construction: you fix only custom code, only in DEV, only behind a transport, and only after a confirmation gate — and you never claim a fix you did not prove with a red->green test transition.

Task: $ARGUMENTS

This skill observes `shared/rules/skill_operating_rules.md`. **Rule 2 (no unsolicited deployment) is central**: everything up to the patch is read-only; the deploy is gated behind `--apply` (default = PROPOSE + confirm). It is the write-capable companion to the read-only `/sap-diagnose`.

---

Shared Resources

| File / token | Path | Purpose | |---|---|---| | `safety_policy.md` | `<SAP_DEV_CORE_SHARED_DIR>\rules\safety_policy.md` | **Rule 0 (highest priority)** — environment guard; Step 0.6 runs `sap_safety_gate.ps1 -Action assert` | | `skill_operating_rules.md` | `<SAP_DEV_CORE_SHARED_DIR>\rules\skill_operating_rules.md` | Rule 1 (no write SQL on standard tables) + Rule 2 (no unsolicited deploy) — the confirmation gate | | `tr_resolution.md` | `<SAP_DEV_CORE_SHARED_DIR>\rules\tr_resolution.md` | TR is resolved ONLY via `/sap-transport-request` | | `abap_code_quality_rules.md` | `<SAP_DEV_CORE_SHARED_DIR>\rules\abap_code_quality_rules.md` | the patch must stay modern-syntax + message-class clean (no literal MESSAGE strings, no obsolete forms) | | `settings_lookup.md` | `<SAP_DEV_CORE_SHARED_DIR>\rules\settings_lookup.md` | per-key settings merge; per-connection pin | | `sap_settings_lib.ps1` + `sap_connection_lib.ps1` | `<SAP_DEV_CORE_SHARED_DIR>\scripts\` | `Get-SapWorkDir`, pinned profile, `Get-SapCurrentSessionPath` | | `sap_object_resolver.ps1` (`%%OBJECT_RESOLVER_PS1%%`) | `<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_object_resolver.ps1` | `Resolve-SapObject` — Z/Y? package? **which system**? active? | | `sap_rfc_read_source.ps1` | `<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_rfc_read_source.ps1` | `Read-SapAbapSource` (program / include / FM) for the patch | | `sap_finding_lib.ps1` / `sap_gate_policy.ps1` / `sap_artifact_lib.ps1` | `<SAP_DEV_CORE_SHARED_DIR>\scripts\` | finding model + gate + artifact registration | | `diagnose_evidence_schema.json` | `<SAP_DEV_CORE_SHARED_DIR>\..\skills\sap-diagnose\references\diagnose_evidence_schema.json` | the `dump_detail` input contract this skill consumes | | `sap_log_helper.ps1` | `<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1` | structured logging |

**Skills this one orchestrates** (skills-first, per CLAUDE.md Rule 6 — invoke via the Skill tool, never re-implement): `/sap-st22` (`--deep`), `/sap-explain-object`, `/sap-gen-abap-unit`, `/sap-run-abap-unit`, `/sap-check-abap`, `/sap-se38`, `/sap-se37`, `/sap-se24`, `/sap-activate-object`, `/sap-transport-request`, `/sap-transport-readiness`, `/sap-se01`, `/sap-stms`.

`<SAP_DEV_CORE_SHARED_DIR>` = `plugins/sap-dev-core/shared` — 3 levels up from `<SKILL_DIR>`, then into `sap-dev-core\shared`.

---

Step 0 — Resolve Work Directory and Settings

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir)); Write-Output ('CUSTOM_URL=' + (Get-SapSettingValue 'custom_url' ((Get-SapWorkDir) + '\custom')))"

Settings reads/writes follow `<SAP_DEV_CORE_SHARED_DIR>/rules/settings_lookup.md`. Set `{WORK_TEMP}` = `{work_dir}\temp`, `{RUN}` = `{WORK_TEMP}\fix_incident\<run>`:

cmd /c if not exist "{WORK_TEMP}\fix_incident" mkdir "{WORK_TEMP}\fix_incident"

Set `{RUN_TEMP}` = the per-run scratch dir (`Get-SapRunTemp` mints + creates `{work_dir}\temp\run_<id>`):

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

Per the CLAUDE.md "Two-bucket temp model" write this skill's `_run.json` log state under `{RUN_TEMP}` (the working files already live in the per-run `{RUN}`).

Step 0.5 — Start Logging (best-effort)

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_fix_incident_run.json" -Skill sap-fix-incident -ParamsJson "{}"

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

This skill deploys a fix (via delegated deploy skills, which gate themselves too). Run the gat