Menu
Incident discipline — severity, containment-first, comms, blameless postmortems. Load when production is (or might be) on fire.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Context engineering — memory navigation, textual graph traversal, progressive disclosure, recovery. Load when assembling context for a task or when lost.
Implementation-side security discipline — headers, dependencies, secrets, authz. Load for hardening work (sec-ops domain).
Commit conventions, branching, anchors in messages, and the git safety rules. Load for any git operation beyond status/diff.
Anti-generic-AI design discipline — bans, tells, and the slop test. Load for ANY new UI surface or visual redesign. Inspired by Impeccable (Apache 2.0).
Motion & animation discipline — purpose, performance, reduced-motion. Load when work involves animation, transitions or scroll effects.
Microcopy discipline — buttons, errors, empty/loading/success states, alt text. Voice and tone come from the project's memory, not from this skill.
| name | incident-response |
| description | Incident discipline — severity, containment-first, comms, blameless postmortems. Load when production is (or might be) on fire. |
Universal discipline; paging/tooling from memory-long §stack. The agent's role in incidents: assist diagnosis, propose actions — destructive/prod mutations remain human-executed (guardrails do not relax under pressure; that's when they matter most).
SEV1 users down/data at risk — all hands, comms cadence · SEV2 degraded with workaround — owner + updates · SEV3 contained annoyance — ticket it. When unsure between two levels, pick the higher — downgrading is cheap, upgrading late is not.
Contain → diagnose → fix → learn. Stop the bleeding first (rollback, kill switch, scale, failover — this is why release-engineering rollbacks are one command) · diagnosis uses telemetry (correlation IDs earn their keep now — see observability), not guesswork restarts · no fix without a hypothesis — "restart and hope" without a theory destroys the evidence.
One incident commander (decisions), one scribe (timeline — timestamps of actions/observations, raw and unpolished) · comms on a cadence (even "no update yet" at the promised time) · changes during incident are minimal and reversible — the heroic 500-line hotfix at 3am is tomorrow's SEV1.
Within days, not weeks · timeline → contributing factors (plural — single root cause is almost always a simplification) → action items with owners and dates · blameless means systems-focused: "the deploy lacked a canary" not "X deployed carelessly" · every postmortem feeds the harness: new guardrail/hook candidate, eval anti-check, or memory-long constraint — an incident that doesn't harden the system will repeat.
Runbooks exist for the top failure modes and are tested (game days — see resilience) · postmortem action items tracked as DEBT-/FEAT- anchors, not lost in docs · incident metrics honest: MTTR trends, repeat-incident rate.
