Incident response — field guides

Record status

Record ID

project:incident-response

Parent lifecycle

candidate

Page lane

app_features

Lane lifecycle

proposed

Owner

Not separately recorded

Owner role

Not separately recorded

Owner status

Not separately recorded

Qualification result

NOT RUN · held for evidence and human review

Working browser surface: Project templates & workflows — overview — Create a local project from this template and validate its forms. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held.

Related field-guide records

No separate guide route is admitted for this project or job.

Source-proposed guide paths are references, not proof that those paths resolve.

Operating sequence

1. Create the project record and assign an incident coordinator.
2. Complete intake with observed facts, timestamps, source references, and explicit unknowns.
3. Propose severity and scope; record confirmation status separately from suspicion.
4. Define milestones for detection, containment, evidence preservation, recovery, observation, and retrospective review.
5. Assign each milestone, deadline, dependency, and evidence item an owner and backup where available.
6. Build the workback from the target recovery or review time and record buffers and replan triggers.
7. Link the applicable Notebook notes, files, to-dos, agenda items, messages, approvals, and agent logs.
8. Preserve evidence as source-labelled references with provenance, revision, and custody state; hold protected upload where unavailable.
9. Route consequential actions and communications through Approvals; keep final external send and writes human-held.
10. Review blockers, risks, overdue items, and incomplete evidence at each milestone transition.
11. Record recovery evidence and an observation window before proposing closure.
12. Complete the retrospective, create follow-up to-dos with dueAt values, record residual risks, and obtain closure approval.

Handoff boundary

• Confusing a local prototype or index with a connected incident-management backend.
• Treating suspected scope, impact, recovery, or customer effect as confirmed without source evidence.
• Publishing sensitive incident details or indexing customer information beyond the supplied records.
• Using stale, incomplete, or altered evidence without provenance, revision, or custody review.
• Allowing deadline or workback automation to create external effects without human approval.
• Marking recovery or closure complete while blockers, observation, approvals, or follow-up work remain unresolved.
• Loss of access, unavailable local file references, missing source hashes, conflicting timestamps, duplicate records, and circular dependencies.
• Accessibility failures that hide severity, status, errors, deadlines, or approval state.

Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

• source_record:project:incident-response
• project:incident-response
• NotebookCollectionKind.project
• NotebookTodoPayload.dueAt
• Notebook Agenda deadlines/workbacks
• Notebook records canonical IDs, origin, source locators, source SHA-256, provenance, revision, lifecycle, tags, links, attachments, and record revisions
• PointGuard persistent cross-app context surface
• APP_ROUTES:/app/notebook/projects/
• APP_ROUTES:/app/notebook/to-dos/
• APP_ROUTES:/app/notebook/agenda/
• APP_ROUTES:/app/notebook/files/
• APP_ROUTES:/app/notebook/approvals/
• APP_ROUTES:/app/notebook/messages/
• APP_ROUTES:/app/notebook/agent-logs/
• APP_ROUTES:/app/pointguard/
• Notebook records provenance and revision contract