Discipline for the full incident lifecycle, declaring and sizing an incident by severity, separating the incident-commander/comms/ops roles, mitigating before root-causing, and writing a blameless postmortem that investigates the system rather than a person. Use when a production incident is happening or just resolved, when the user asks to declare an incident, run an incident response, write a postmortem, or asks who's in charge during an outage.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Incident Response
An incident is a sequence of distinct phases, each with a different job; declaring it is not the same task as fixing it, and fixing it is not the same task as understanding why it happened. The postmortem investigates **the system**, never a person: "who broke it" is the wrong question; "what condition in the system allowed this to break, and how do we change that condition" is the right one. This builds on `observability`'s alert/runbook phase (that's how an incident gets detected and where the first response steps live) but covers the incident's lifecycle after that point.
## Phase 1: Detect and declare
- Assign a **severity** at declaration time, sized to actual user impact, not to how alarming the alert sounds: SEV1 (full outage or data loss, all hands, immediate), SEV2 (significant degradation, a subset of users or a non-critical path), SEV3 (minor, workaround exists, no active user harm). The severity gates how much process kicks in; a SEV3 doesn't need the full incident-commander machinery below.
…
The line at the top of this page pins the label git:20260809.2a45dbb, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.
pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (6166 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag
Source
GitHub
aethrox/doctrine · 19 stars · license MIT · pushed 2026-09-11 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_nkvobcuohvfgmkh5
GET https://markdownregistry.com/api/v1/resolve?ref=aethrox/doctrine/incident-response
GET https://markdownregistry.com/api/v1/blob/6fd33741519060df668d1789c6a52c7362dbcc47705c7bc8907ee4895c3d0727
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
aethrox/doctrine · skills/api-design-standards/SKILL.md · API design discipline grounded in the Microsoft/Google REST guidelines, resource and URL conventions, a chosen…
aethrox/doctrine · skills/architecture-diagram/SKILL.md · Produce a software architecture diagram at the right level of zoom, using diagram as code so it can be shown inline…
aethrox/doctrine · skills/capacity-estimation/SKILL.md · Turn a vague performance requirement into arithmetic before the architecture is chosen, size concurrency with Little's…
aethrox/doctrine · skills/code-review/SKILL.md · Code review discipline: the approval bar is "improves code health," not "perfect," Fowler's code-smell catalog gives…
aethrox/doctrine · skills/code-style-lint/SKILL.md · Discipline for code style and static analysis, adopt the ecosystem's established formatter as the non-negotiable source…
aethrox/doctrine · skills/codebase-design/SKILL.md · Module design discipline from John Ousterhout's A Philosophy of Software Design, depth as the metric (a lot of…
aethrox/doctrine · skills/dependency-upgrade-management/SKILL.md · Discipline for keeping dependencies current and deprecating capabilities safely, an inventory (SBOM) of what's actually…
aethrox/doctrine · skills/diagnosing-bugs/SKILL.md · Systematic debugging discipline based on David Agans' nine rules, understand the system, reproduce reliably, bisect the…
aethrox/doctrine · skills/domain-modeling/SKILL.md · Domain-Driven Design discipline, build a ubiquitous language shared by code and conversation, draw explicit bounded…
aethrox/doctrine · skills/explain-plainly/SKILL.md · Default to explaining technical work in plain language for a non-technical audience, using an existing project glossary…
aethrox/doctrine · skills/grilling/SKILL.md · Interview the user relentlessly, in rounds, to close the gap between what's known and what's needed before acting on a…
aethrox/doctrine · skills/handoff/SKILL.md · Hand off in-progress work, an on-call shift, or an open incident to another person or agent using a fixed four-part…
cbrock84/headcount · plugins/security/skills/incident-response/SKILL.md · Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review…
rampstackco/claude-skills · skills/incident-response/SKILL.md · Manage active production incidents through detection, triage, mitigation, communication, and resolution with structured…
hypnguyen1209/offensive-claude · skills/incident-response/SKILL.md · Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3…
stbenjam/skillsaw · tests/fixtures/apm/clean/.apm/skills/incident-response/SKILL.md · Triage and respond to production incidents. Use when handling an outage.
nahid-sparktales/agent-dispatcher · skills/devops/incident-response/SKILL.md · Stabilize a system that is failing right now — name the signal that flagged it, size the blast radius in numbers, keep…
