denzasikora-lab · Aug 8, 2026 · Oct 14, 2026 · Oct 14, 2026
diff --git a/README.md b/README.md
@@ -47,6 +47,16 @@ Manage data quality — create and run assertions (freshness, volume, SQL, field
 > Subscribe me to assertion failures via Slack
 ```
 
+#### ML incident response
+
+Investigate a freshness breach, feature desynchronization, duplicate replay, partial backfill, late event, or stale lineage path. Combines verified metadata, bounded lineage, ownership, remediation, validation, rollback, and a dry-run writeback payload without making an automatic catalog change.
+
+```
+> Payment authorizations are 132 minutes late; what breaks before fraud scoring resumes?
+> Offline velocity is 18 but online serving is 7
+> The pipeline serves fraud_risk_v3 while the catalog says v2
+```
+
 #### Setup
 
 Install the DataHub CLI, configure authentication, verify connectivity, and set up default scopes and profiles for the other interaction skills.
@@ -144,6 +154,7 @@ Then:
 > /datahub-enrich add description to orders table
 > /datahub-lineage what feeds into the revenue dashboard?
 > /datahub-quality find datasets with failing assertions
+> /datahub-ml-incident-response payment events are late
 > /datahub-setup verify my connection
 > /connector-review snowflake
 > /connector-planning duckdb
@@ -230,6 +241,7 @@ cp -r datahub-skills/skills/datahub-search          your-project/.agents/skills/
 cp -r datahub-skills/skills/datahub-enrich           your-project/.agents/skills/
 cp -r datahub-skills/skills/datahub-lineage          your-project/.agents/skills/
 cp -r datahub-skills/skills/datahub-quality          your-project/.agents/skills/
+cp -r datahub-skills/skills/datahub-ml-incident-response your-project/.agents/skills/
 cp -r datahub-skills/skills/datahub-setup            your-project/.agents/skills/
 cp -r datahub-skills/skills/shared-references        your-project/.agents/skills/
 cp -r datahub-skills/skills/using-datahub            your-project/.agents/skills/
@@ -250,6 +262,7 @@ Each skill directory is self-contained. The `standards` symlinks get dereference
 | Metadata enrichment         | Yes                   | Yes                                              |
 | Lineage exploration         | Yes                   | Yes                                              |
 | Data quality management     | Yes                   | Yes                                              |
+| ML incident response        | Yes                   | Yes                                              |
 | Connection setup            | Yes                   | Yes                                              |
 | Planning workflow           | Yes                   | Yes                                              |
 | Load standards              | Yes                   | Yes                                              |
@@ -265,13 +278,14 @@ Other platforms do the same things through natural language.
 
 ### Catalog interaction
 
-| Command                     | What it does                                    |
-| --------------------------- | ----------------------------------------------- |
-| `/catalog-search [query]`   | Search the catalog and answer questions         |
-| `/catalog-enrich [entity]`  | Add or update metadata                          |
-| `/catalog-lineage [entity]` | Explore lineage and trace dependencies          |
-| `/catalog-quality [entity]` | Manage assertions, incidents, and subscriptions |
-| `/catalog-setup [task]`     | Set up connection and configure defaults        |
+| Command                                    | What it does                                    |
+| ------------------------------------------ | ----------------------------------------------- |
+| `/catalog-search [query]`                  | Search the catalog and answer questions         |
+| `/catalog-enrich [entity]`                 | Add or update metadata                          |
+| `/catalog-lineage [entity]`                | Explore lineage and trace dependencies          |
+| `/catalog-quality [entity]`                | Manage assertions, incidents, and subscriptions |
+| `/catalog-ml-incident-response [incident]` | Investigate ML data incidents safely            |
+| `/catalog-setup [task]`                    | Set up connection and configure defaults        |
 
 ### Connector development
 
@@ -322,6 +336,9 @@ datahub-skills/
 │   │   ├── SKILL.md
 │   │   ├── references/
 │   │   └── templates/
+│   ├── datahub-ml-incident-response/ # Safe ML incident investigation
+│   │   ├── SKILL.md
+│   │   └── templates/
 │   ├── datahub-setup/               # Connection setup and config
 │   │   ├── SKILL.md
 │   │   ├── references/
@@ -354,6 +371,7 @@ datahub-skills/
 │   ├── catalog-enrich.md
 │   ├── catalog-lineage.md
 │   ├── catalog-quality.md
+│   ├── catalog-ml-incident-response.md
 │   ├── catalog-setup.md
 │   ├── connector-planning.md
 │   ├── connector-review.md
@@ -373,7 +391,7 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for commit conventions and release proces
 
 Where things live:
 
-- Catalog interaction skills: `skills/datahub-search/`, `skills/datahub-enrich/`, `skills/datahub-lineage/`, `skills/datahub-quality/`, `skills/datahub-setup/`
+- Catalog interaction skills: `skills/datahub-search/`, `skills/datahub-enrich/`, `skills/datahub-lineage/`, `skills/datahub-quality/`, `skills/datahub-ml-incident-response/`, `skills/datahub-setup/`
 - Shared references: `skills/shared-references/`
 - Connector standards: `standards/`
 - Review checklists: `skills/datahub-connector-pr-review/SKILL.md`

diff --git a/commands/catalog-ml-incident-response.md b/commands/catalog-ml-incident-response.md
@@ -0,0 +1,25 @@
+---
+name: catalog-ml-incident-response
+description: Investigate an ML data incident through verified DataHub context and prepare a safe remediation
+argument-hint: "[incident evidence or affected asset]"
+---
+
+# DataHub ML Incident Response
+
+Use the Skill tool to invoke the full `datahub-ml-incident-response` skill:
+
+```text
+Skill tool:
+  skill: "datahub-skills:datahub-ml-incident-response"
+```
+
+**User's request:** $ARGUMENTS
+
+This skill:
+
+1. classifies freshness, feature skew, replay, backfill, late-event, or stale-lineage incidents;
+2. verifies assets and traces bounded lineage through MCP tools or the DataHub CLI;
+3. routes owners and produces remediation, validation, rollback, and a dry-run report envelope;
+4. previews any requested live operation and hands it off only within explicit authorization for the verified target and operation.
+
+If no arguments are provided, ask for the affected asset and the observed incident evidence.
diff --git a/skills/datahub-ml-incident-response/README.md b/skills/datahub-ml-incident-response/README.md
@@ -0,0 +1,19 @@
+# DataHub ML Incident Response
+
+Investigate ML data incidents with verified DataHub metadata and lineage, then prepare a safe, owner-ready remediation.
+
+## What it does
+
+1. Classifies six common ML incidents: freshness, feature desync, duplicate replay, partial backfill, late events, and stale lineage.
+2. Verifies entity URNs, reads bounded downstream lineage, and enriches the graph with schema and ownership evidence.
+3. Explains the specific model, feature, and transformation impact.
+4. Produces remediation, validation, rollback, and a dry-run report envelope that must not be sent directly to an API.
+5. Previews requested live operations and hands off to DataHub Quality or Enrich only within explicit authorization for the verified target and operation.
+
+## Usage
+
+```text
+/datahub-ml-incident-response payment authorizations are 132 minutes late
+/datahub-ml-incident-response offline velocity is 18 but online is 7
+/datahub-ml-incident-response the pipeline serves fraud_risk_v3 but the catalog says v2
+```