pilot-incident-evidence

Generate incident close-out evidence packs with fingerprinted receipts and chained attestations.

14|Updated Jan 17, 2026
One-click install
npx skills add https://github.com/confighub/cub-scout --skill pilot-incident-evidence
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: pilot-incident-evidence
Source: https://github.com/confighub/cub-scout/tree/main/skills/pilot-incident-evidence
Command: npx skills add https://github.com/confighub/cub-scout --skill pilot-incident-evidence

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It solves the problem of producing trustworthy, immutable incident evidence and a clear verdict after an outage so postmortems and audits can rely on what actually happened.

Core Features & Use Cases

  • Judge-driven incident close-out packs: render an incident-level verdict plus a structured evidence bundle for downstream consumers (postmortem, audit ticket, compliance review).
  • Per-resource attribution and timelines: gather owner/lineage, explainability, three-way comparisons, and recent change history for each affected resource.
  • Fingerprintable receipts with chained attestations: generate receipts with chained input attestations across multiple stages so later tampering invalidates the chain.
  • Cluster-wide replayable artifacts: capture bundle and snapshot outputs for offline replay and durable incident documentation.

Quick Start

Use the pilot-incident-evidence skill to render an immutable incident evidence pack and verdict for incident close-out by capturing per-resource trace, explain, compare, history, and receipt verify artifacts, then chaining receipts across stages and assembling the resulting bundle and snapshot for your audit workflow.

Frequently Asked Questions about pilot-incident-evidence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate tamper-evident Kubernetes incident evidence for a postmortem?

To generate tamper-evident Kubernetes incident evidence, collect read-only cluster and GitOps facts to produce fingerprinted receipts and chained attestations. This creates an immutable evidence pack and verdict for postmortems and audits.

What is the best way to capture GitOps change history for an incident verdict?

Capturing GitOps change history for an incident verdict involves gathering per-resource attribution, explainability, and recent change history. This structured evidence supports judge-driven incident completion and compliance reviews.

Can I create offline replayable artifacts for Kubernetes incident close-out?

Yes, you can create offline replayable artifacts by capturing cluster-wide bundle and snapshot outputs. These durable artifacts document the incident state for offline replay and compliance verification.

How do fingerprinted receipts with chained attestations protect incident evidence?

Fingerprinted receipts with chained attestations protect incident evidence by linking inputs across multiple stages. Any later tampering invalidates the chain, ensuring the postmortem evidence remains durable and trustworthy.

Does this incident evidence process require specific dependencies to work?

No specific dependencies are required to run this incident evidence process. It operates independently to gather read-only Kubernetes facts and generate structured evidence packs for downstream audit workflows.