Source: https://guthlabs.ai/docs/jobs/stan-sre-and-incident-command/field-guides/

job / candidate

# SRE and incident command — field guides

The distinct field guides record for SRE and incident command. This page is proposal-only.

Status: **proposed**Lifecycle: **candidate**

## Record status

**Record ID**: job:stan:sre-and-incident-command

**Parent lifecycle**: candidate

**Page lane**: docs_urls

**Lane lifecycle**: proposed

**Owner**: Stan

**Owner role**: Chief Security and Engineering Officer

**Owner status**: VERIFIED

**Qualification result**: NOT RUN · held for evidence and human review

**Working browser surface:** [Agent jobs — builder overview](<https://guthlabs.ai/guth.html#builder>) — Inspect the package and stage a local project. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held.

## Related field-guide records

No separate guide route is admitted for this project or job.

Source-proposed guide paths are references, not proof that those paths resolve.

## Operating sequence

- Open or create a source-bound current-work packet in Notebook and PointGuard.

- Classify the request as incident response, reliability review, security review, continuity work, or follow-up.

- Record observations separately from assumptions, confidence, and proposed actions.

- Assign a provisional severity and accountable human reviewer; do not treat severity or confidence as permission.

- Create an incident timeline and ordered workback with explicit dueAt values and fallback states.

- Gather only source-labelled evidence and preserve canonical IDs, provenance, revisions, links, attachments, and receipts.

- Use designated instruments only for bounded educational or verification calculations; retain inputs, outputs, assumptions, and instrument slug.

- Prepare containment, remediation, communication, or recovery proposals without executing external effects.

- Route destructive remediation, purchasing or money, credential changes, public deployment, and legal filing proposals to Approvals.

- Draft communications in Notebook Messages and hold final external send for human review.

- Update Agent Logs and the receipt ledger after each material proposal, decision, hold, or failure.

- Close only when evidence, residual risk, owner, follow-up deadlines, and unresolved gates are recorded; otherwise leave the work held.

## Handoff boundary

- Confidence may be mistaken for authorization; all effects require the applicable human gate.

- A plausible incident narrative may exceed the supplied evidence; preserve observation and inference separately.

- Destructive remediation can worsen outages or destroy evidence; require reversibility, rollback, and approval.

- Credential changes and provider operations can create security or continuity risk; keep them held.

- Database, customer, publication, and production claims may be inferred from named routes; native surfaces do not prove connected features.

- Hashes and receipts establish recorded comparison, not authenticity, ownership, or legal admissibility.

- Educational availability calculations can be mistaken for live SLA measurements.

- Incident communications can disclose sensitive details or make unsupported public claims; use least disclosure and human review.

- Deadline pressure can cause unsafe shortcuts; overdue work must escalate or remain held rather than silently execute.

- Incomplete provenance, conflicting revisions, or inaccessible evidence can produce false closure.

- Agent ownership by Stan does not manufacture Antonio's authority or authorize actions outside the stated gates.

## Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

- `agents/index.html#stan`

- `source_record:job:stan:sre-and-incident-command`

- `source_record.owner_agent=Stan`

- `source_record.owner_role=Chief Security and Engineering Officer`

- `source_record.existing_tools=Assurance preflight; Terminal courier; Receipt ledger; Source-bound recall`

- `source_record.existing_guides=Security field guides; Supabase field guide; Cloudflare operations; Current-work packets`

- `source_record.principal_gates=Destructive remediation; Money or purchasing; Credential changes; Public deployment; Legal filing`

- `source_record.never_rules=Manufacture Antonio's authority; Treat confidence as permission; Convert a proposal into an effect`

- `observed_native_contract.records`

- `observed_native_contract.deadlines`

- `observed_native_contract.pointguard`

- `observed_native_contract.web_boundary`

- `app_routes:/app/pointguard/`

- `app_routes:/app/notebook/approvals/`

- `app_routes:/app/notebook/agent-logs/`

- `app_routes:/app/notebook/to-dos/`

- `app_routes:/app/notebook/messages/`

- `app_routes:/app/business/home/`

- `app_routes:/app/business/vault/`

- `job:stan:sre-and-incident-command`

- `Observed native contract: project_and_field_guide_collections`

- `Observed native contract: deadlines`

- `Observed native contract: records`

- `Observed native contract: pointguard`

- `Observed native contract: web_boundary`

- `/app/pointguard/`

- `/app/notebook/approvals/`

- `/app/notebook/agent-logs/`

- `/app/notebook/field-guides/`

- `/app/notebook/projects/`

- `/app/notebook/search/`