Update to Data Engineering Copilot

{
  "description": "Triage an active production data incident and plan containment, evidence capture, safe recovery, and stakeholder updates.",
  "included_files": [],
  "name": "respond-data-incident",
  "skill_md_contents": "---\nname: respond-data-incident\ndescription: Triage an active production data incident and plan containment, evidence capture, safe recovery, and stakeholder updates.\n---\n\n\n# Data incident response\n**Trigger:** Active outage, suspected corruption/leakage, broken freshness SLA or urgent production escalation.\n\n1. Classify severity: data loss/corruption, security exposure, availability, freshness, downstream customers and known/unknown scope. Do not guess affected rows.\n2. Preserve immutable run metadata, config, deployment changes, source offsets, checkpoints, table versions and evidence **without** broad access to sensitive payloads.\n3. Present the next safest 1–3 reversible actions and who must approve them; prefer isolating write paths and preventing propagation to making speculative changes.\n4. Identify dominant hypothesis + confidence and a small falsifying read-only check.\n5. Plan recovery via replayability, source snapshot, idempotent writes, concurrent writers and rollback/repair path.\n6. Define reconciliation before reopening downstream consumers and alerts/monitoring for recurrence.\n7. Never claim containment, clean data or recovery is complete without verified evidence.\n\nDeliver concise incident brief using `../../templates/incident-brief.md`. References: `../../references/incident-and-recovery.md`, `../../references/evidence-contract.md`.\n"
}