Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add manishiitg/coding-agent-loop --skill incident-to-verified-recoverygit clone --depth 1 https://github.com/manishiitg/coding-agent-loopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/manishiitg/coding-agent-loop/incident-to-verified-recovery)<a href="https://agentmods.dev/skills/manishiitg/coding-agent-loop/incident-to-verified-recovery"><img src="https://agentmods.dev/badge/skills/manishiitg/coding-agent-loop/incident-to-verified-recovery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/manishiitg/coding-agent-loop/incident-to-verified-recovery"><img src="https://agentmods.dev/badge/skills/manishiitg/coding-agent-loop/incident-to-verified-recovery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00661 |
| Opus 5.5 | $0.00011 | $0.00264 |
| Sonnet 5.5 | $0.00005 | $0.00132 |
| Haiku 4.5 | $0.00003 | $0.00066 |
Grade A, and why
incident-to-verified-recovery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Incident to Verified Recovery
Outcome
Produce a sourced incident timeline, an owned delivery or rollback decision, and observed recovery evidence. A PR, green build, or completed deployment alone does not prove service recovery.
When to use
Use when an incident needs investigation across telemetry and a governed engineering follow-through. One compatible Crew may fill both slots with separate validated outputs.
Discovery and user direction
Inspect existing Crews, incident manager, alerts, metrics, logs, deploy history, owners, and recovery policy. Propose reuse or creation and show a concrete plan before Builder applies it. Installation copies this guide and pending SETUP.json; it runs nothing.
Required inputs
Confirm incident ID, service, environment, impact window, timezone, owner, escalation rule, authorized source scope, and measurable recovery rule. Bounded exports support manual read-only investigation.
Plan and AgentWorks tools
Reuse or propose Incident Investigator and Engineering Delivery Coordinator. Builder may use create_crew with stable keys for missing Crews. Investigation writes incident-investigation/v1 with a sourced timeline, impact, hypotheses, and proposed action. Validate with scripts/validate_handoff.py --incident-only <incident.json> before Delivery reads it. Delivery joins exact issue, PR, commit, CI, and deploy IDs and emits engineering-blocker-ledger/v1. Validate the pair, present the exact action for owner review, then execute only through an authorized route. Re-read telemetry over the agreed observation window before reporting recovery.
Knowledge and persistence
Keep stable incident, service, action, issue, PR, commit, deploy, approval, and run IDs; source times; validation results; and prior notifications. Recheck current status before a repeat to prevent duplicate tickets or remediation.
Validation and reporting
The handoff validator checks bounded artifacts. The fictional incident and ledger pass; the invalid ledger fails. The reporting dashboard shows investigated, pending approval, delivered, recovered, not recovered, and unknown states with sources and run cost. Structure validation cannot prove source truth or recovery.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- examples/engineering-blocker-ledger.json 513 B
- examples/incident-investigation.json 992 B
- examples/invalid-engineering-blocker-ledger.json 451 B
- playbook.json 4.2 KB
- references/team-and-handoffs.md 1.9 KB
- scripts/test_validate_handoff.py 1.2 KB runs code
- scripts/validate_handoff.py 5.3 KB runs code
- SETUP.json 2.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago First seen · 48 lines · 27 tokens per session scan A 77a6f4d536bb
incident-to-verified-recovery is a skill published in the GitHub repository manishiitg/coding-agent-loop (13 stars, last pushed 19d ago), licensed MIT. It adds 27 tokens to every session and 661 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-27.
Other skills, from other repositories
ci-troubleshoot
Diagnose failed GitHub Actions runs for pi-agent-dashboard: the 11-file workflow taxonomy, affected-test selection, the release pipeline, known failure modes, and how to read gh run logs and retrigger jobs. Use when a CI run is red, a release is stuck, a workflow won't dispatch, or you need to know which workflow does…
performance-optimization
Measure-first performance work. Use on triggers like "it's slow", "profile this", "optimize perf", "fix the bottleneck", "improve load time / Core Web Vitals", or when a measured regression needs fixing. Enforces measure-before-optimize. Fills a perf gap not covered by existing project skills. Not a build/ship…
node-inspect-debugger
See runtime state a console.log cannot reach — set real breakpoints, step, and dump the scope chain of a paused Node/TypeScript process. Use on "set a breakpoint", "inspect runtime state", "console.log isn't enough", "step through this", "what's in this closure at runtime", "attach a debugger". Not a logging or…
debug-dashboard
Diagnose problems in the running pi-agent-dashboard system: server.log, /api/health, bridge WebSocket connectivity, vitest triage, known-issue FAQ entries. Routes UI/visual issues to the browser skill. Use when the server seems hung, a pi session won't connect, tests fail mysteriously, the dashboard shows a blank…
systematic-debugging
Root-cause a bug already in front of you, instead of guessing at fixes. Use on triggers like "root cause this", "why is this failing", "debug systematically", "this test is flaky", "it works locally but not in CI", or when a fix attempt has already failed once. Enforces a phased evidence-first process before any code…
canvas-webapp
Render a React/Vite (or any bundled) web app on the pi-dashboard canvas, which loads loopback URLs in a sandboxed opaque-origin iframe. Use when a canvas(target:{kind:"url"|"server"}) target shows up blank white, an empty surface, or a /live/ 500 ECONNREFUSED. Covers why Vite dev servers and non-CORS static servers…