Source: https://guthlabs.ai/docs/project-templates/incident-response/field-guides/ project template / candidate # Incident response โ€” field guides The distinct field guides record for Incident response. This page is proposal-only. Status: **proposed**Lifecycle: **candidate** ## Record status **Record ID**: project:incident-response **Parent lifecycle**: candidate **Page lane**: app_features **Lane lifecycle**: proposed **Owner**: Not separately recorded **Owner role**: Not separately recorded **Owner status**: Not separately recorded **Qualification result**: NOT RUN ยท held for evidence and human review **Working browser surface:** [Project templates & workflows โ€” overview]() โ€” Create a local project from this template and validate its forms. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held. ## Related field-guide records No separate guide route is admitted for this project or job. Source-proposed guide paths are references, not proof that those paths resolve. ## Operating sequence - Create the project record and assign an incident coordinator. - Complete intake with observed facts, timestamps, source references, and explicit unknowns. - Propose severity and scope; record confirmation status separately from suspicion. - Define milestones for detection, containment, evidence preservation, recovery, observation, and retrospective review. - Assign each milestone, deadline, dependency, and evidence item an owner and backup where available. - Build the workback from the target recovery or review time and record buffers and replan triggers. - Link the applicable Notebook notes, files, to-dos, agenda items, messages, approvals, and agent logs. - Preserve evidence as source-labelled references with provenance, revision, and custody state; hold protected upload where unavailable. - Route consequential actions and communications through Approvals; keep final external send and writes human-held. - Review blockers, risks, overdue items, and incomplete evidence at each milestone transition. - Record recovery evidence and an observation window before proposing closure. - Complete the retrospective, create follow-up to-dos with dueAt values, record residual risks, and obtain closure approval. ## Handoff boundary - Confusing a local prototype or index with a connected incident-management backend. - Treating suspected scope, impact, recovery, or customer effect as confirmed without source evidence. - Publishing sensitive incident details or indexing customer information beyond the supplied records. - Using stale, incomplete, or altered evidence without provenance, revision, or custody review. - Allowing deadline or workback automation to create external effects without human approval. - Marking recovery or closure complete while blockers, observation, approvals, or follow-up work remain unresolved. - Loss of access, unavailable local file references, missing source hashes, conflicting timestamps, duplicate records, and circular dependencies. - Accessibility failures that hide severity, status, errors, deadlines, or approval state. ## Sources and evidence These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment. - `source_record:project:incident-response` - `project:incident-response` - `NotebookCollectionKind.project` - `NotebookTodoPayload.dueAt` - `Notebook Agenda deadlines/workbacks` - `Notebook records canonical IDs, origin, source locators, source SHA-256, provenance, revision, lifecycle, tags, links, attachments, and record revisions` - `PointGuard persistent cross-app context surface` - `APP_ROUTES:/app/notebook/projects/` - `APP_ROUTES:/app/notebook/to-dos/` - `APP_ROUTES:/app/notebook/agenda/` - `APP_ROUTES:/app/notebook/files/` - `APP_ROUTES:/app/notebook/approvals/` - `APP_ROUTES:/app/notebook/messages/` - `APP_ROUTES:/app/notebook/agent-logs/` - `APP_ROUTES:/app/pointguard/` - `Notebook records provenance and revision contract`