SRE and incident command — field guides

Record status

Record ID

job:stan:sre-and-incident-command

Parent lifecycle

candidate

Page lane

docs_urls

Lane lifecycle

proposed

Owner

Stan

Owner role

Chief Security and Engineering Officer

Owner status

VERIFIED

Qualification result

NOT RUN · held for evidence and human review

Working browser surface: Agent jobs — builder overview — Inspect the package and stage a local project. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held.

Related field-guide records

No separate guide route is admitted for this project or job.

Source-proposed guide paths are references, not proof that those paths resolve.

Operating sequence

1. Open or create a source-bound current-work packet in Notebook and PointGuard.
2. Classify the request as incident response, reliability review, security review, continuity work, or follow-up.
3. Record observations separately from assumptions, confidence, and proposed actions.
4. Assign a provisional severity and accountable human reviewer; do not treat severity or confidence as permission.
5. Create an incident timeline and ordered workback with explicit dueAt values and fallback states.
6. Gather only source-labelled evidence and preserve canonical IDs, provenance, revisions, links, attachments, and receipts.
7. Use designated instruments only for bounded educational or verification calculations; retain inputs, outputs, assumptions, and instrument slug.
8. Prepare containment, remediation, communication, or recovery proposals without executing external effects.
9. Route destructive remediation, purchasing or money, credential changes, public deployment, and legal filing proposals to Approvals.
10. Draft communications in Notebook Messages and hold final external send for human review.
11. Update Agent Logs and the receipt ledger after each material proposal, decision, hold, or failure.
12. Close only when evidence, residual risk, owner, follow-up deadlines, and unresolved gates are recorded; otherwise leave the work held.

Handoff boundary

• Confidence may be mistaken for authorization; all effects require the applicable human gate.
• A plausible incident narrative may exceed the supplied evidence; preserve observation and inference separately.
• Destructive remediation can worsen outages or destroy evidence; require reversibility, rollback, and approval.
• Credential changes and provider operations can create security or continuity risk; keep them held.
• Database, customer, publication, and production claims may be inferred from named routes; native surfaces do not prove connected features.
• Hashes and receipts establish recorded comparison, not authenticity, ownership, or legal admissibility.
• Educational availability calculations can be mistaken for live SLA measurements.
• Incident communications can disclose sensitive details or make unsupported public claims; use least disclosure and human review.
• Deadline pressure can cause unsafe shortcuts; overdue work must escalate or remain held rather than silently execute.
• Incomplete provenance, conflicting revisions, or inaccessible evidence can produce false closure.
• Agent ownership by Stan does not manufacture Antonio's authority or authorize actions outside the stated gates.

Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

• agents/index.html#stan
• source_record:job:stan:sre-and-incident-command
• source_record.owner_agent=Stan
• source_record.owner_role=Chief Security and Engineering Officer
• source_record.existing_tools=Assurance preflight; Terminal courier; Receipt ledger; Source-bound recall
• source_record.existing_guides=Security field guides; Supabase field guide; Cloudflare operations; Current-work packets
• source_record.principal_gates=Destructive remediation; Money or purchasing; Credential changes; Public deployment; Legal filing
• source_record.never_rules=Manufacture Antonio's authority; Treat confidence as permission; Convert a proposal into an effect
• observed_native_contract.records
• observed_native_contract.deadlines
• observed_native_contract.pointguard
• observed_native_contract.web_boundary
• app_routes:/app/pointguard/
• app_routes:/app/notebook/approvals/
• app_routes:/app/notebook/agent-logs/
• app_routes:/app/notebook/to-dos/
• app_routes:/app/notebook/messages/
• app_routes:/app/business/home/
• app_routes:/app/business/vault/
• job:stan:sre-and-incident-command
• Observed native contract: project_and_field_guide_collections
• Observed native contract: deadlines
• Observed native contract: records
• Observed native contract: pointguard
• Observed native contract: web_boundary
• /app/pointguard/
• /app/notebook/approvals/
• /app/notebook/agent-logs/
• /app/notebook/field-guides/
• /app/notebook/projects/
• /app/notebook/search/