track-followups

Track Follow-Ups

Given follow-up items that have already been triaged, put each one where it will be seen again. A listed follow-up is not a tracked follow-up. This skill creates the item and reports back what it created.

It owns the routing and the creation mechanics. Callers own the triage.

Routing

Kind of item	Destination	Why
Work to be done — defects, features, chores, tech debt, side quests	Your issue tracker (Vikunja)	It is a task; it belongs on the board with everything else
Incidents — outages, anomalies, RCA-worthy events, security findings, weaknesses	The incident system of record (Zammad)	Incidents need a lifecycle, an audit trail, and a place that is not public
Small enough to finish next session (roughly 1–3 tasks)	The next-session prompt	Tracking it would be overhead; it is about to be done

GitHub issues are never created

Public GitHub carries pull requests only. Never open a GitHub issue, and never put an incident narrative, security finding, credential detail, internal hostname, topology, or outage timeline in any GitHub issue, PR body, comment, or commit message. "It is only a side quest" is not an exemption — that reasoning is exactly how operational detail reaches a public repository.

An item that is both an incident and a code fix gets split: an incident ticket and a tracker task, each carrying the other's URL in its description. Cross-linking is a plain URL each way; there is no integration to configure.

Procedure

1. Confirm the tooling is there

Check for mcp__vikunja__* and mcp__zammad__* before anything else. Zammad is attached only where its work happens, so in most repositories reach it over REST instead. It reads ZAMMAD_URL (already ending in /api/v1) and ZAMMAD_HTTP_TOKEN from the environment, for example a .env file loaded into the shell. Never print the token:

# zammad_api <api path> [curl args]
zammad_api() { p=$1; shift; curl -sS \
  -H "Authorization: Token token=$ZAMMAD_HTTP_TOKEN" -H "Content-Type: application/json" \
  "$ZAMMAD_URL$p" "$@"; }
zammad_api /tickets/search -G --data-urlencode limit=5 --data-urlencode expand=false \
  --data-urlencode 'query=state.name:(new OR open) AND title:"<phrase>"'   # search
zammad_api /tickets -X POST -d '<the step 4b ticket as JSON>'              # create
zammad_api /tickets/<id> -X PUT -d '<fields>'                              # update / close