Agent skill · operations · jeremylongshore
palantir-incident-runbook
Triage and stabilize Foundry API, pipeline, application, or Compute Module incidents with evidence-preserving rollback. Use when degraded service, failed builds, access failures, or release regressions require response. Trigger with "Foundry incident" or "Palantir outage".
Why this skill is useful
Provides specific incident response scripts and playbooks for handling Palantir Foundry outages that the AI wouldn't reliably generate on its own.
What it needs
Requires bash installed locally. Requires palantir account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Palantir Foundry Incident Response Overview Protect data integrity and access controls while restoring service. Classify the failing Foundry surface, preserve request/build/release evidence, apply the least risky reversible mitigation, and validate recovery before closing. Prerequisites Name the incident commander, technical owner, data owner, communications owner, severity, affected resources, and start time. Capture request IDs, build IDs, branch/commit, product or artifact version, module state, and recent approved changes. Read references/official-docs.md and the target enrollment's operational procedures. Confirm the rollback authority and protected-data handling rules before collecting logs. Current Contract API 429 or 503 can represent rate or concurrency limiting and should receive bounded backoff rather than an unbounded retry storm. Transform build reports and metrics distinguish queue, CPU, memory, dependency, and data-related failures. DevOps/Marketplace release management can retain prior versions and support controlled upgrades or rollback. Logs may expose sensitive content and require explicit log access plus appropriate markings. Authentication Record grant type, principal, scope names, and application restrictions for API incidents, never token values. Do not rotate credentials until evidence distinguishes an authentication failure from permissions, restrictions, mandatory controls, throttling, or platform availability. Instructions 1. Declare severity, impacted workflow, current data-integrity risk, access-control risk, and the last known healthy version or build. 2. Classify the incident as API/auth, transform/build, OSDK/application, Compute Module, data quality, permissions, or release regression. 3. Preserve bounded evidence and freeze unrelated changes; restrict retries and writeback when integrity is uncertain. 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/palantir-incident-runbook--1bed18