{"id":77124,"plugin_id":"plugins_6ab424ad5b448191b8fede2ebf569333","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-11-03T00:12:27.431Z","digest":"dc2548db8fc4b4927c49f646c72418f37669e05799cbd32a6c04a39ceb47f8e8","against":null,"payload":{"description":"Triage an active production data incident and plan containment, evidence capture, safe recovery, and stakeholder updates.","included_files":[],"name":"respond-data-incident","skill_md_contents":"---\nname: respond-data-incident\ndescription: Triage an active production data incident and plan containment, evidence capture, safe recovery, and stakeholder updates.\n---\n\n\n# Data incident response\n**Trigger:** Active outage, suspected corruption/leakage, broken freshness SLA or urgent production escalation.\n\n1. Classify severity: data loss/corruption, security exposure, availability, freshness, downstream customers and known/unknown scope. Do not guess affected rows.\n2. Preserve immutable run metadata, config, deployment changes, source offsets, checkpoints, table versions and evidence **without** broad access to sensitive payloads.\n3. Present the next safest 1–3 reversible actions and who must approve them; prefer isolating write paths and preventing propagation to making speculative changes.\n4. Identify dominant hypothesis + confidence and a small falsifying read-only check.\n5. Plan recovery via replayability, source snapshot, idempotent writes, concurrent writers and rollback/repair path.\n6. Define reconciliation before reopening downstream consumers and alerts/monitoring for recurrence.\n7. Never claim containment, clean data or recovery is complete without verified evidence.\n\nDeliver concise incident brief using `../../templates/incident-brief.md`. References: `../../references/incident-and-recovery.md`, `../../references/evidence-contract.md`.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}