# Operations runbooks

Runbooks capture operational procedures for incidents, replay verification,
policy emergencies, and airgap workflows. They are designed to be offline
and deterministic.

Runbook set (current)
- docs/runbooks/assistant-ops.md
- docs/runbooks/incidents.md
- docs/runbooks/policy-incident.md
- docs/runbooks/reachability-runtime.md
- docs/runbooks/replay_ops.md
- docs/runbooks/vex-ops.md
- docs/runbooks/vuln-ops.md
- operations/score-proofs.md
- operations/proof-verification.md
- operations/reachability.md
- operations/trust-lattice.md
- operations/unknowns-queue.md
- operations/key-rotation.md

Common expectations
- Hash and store any inbound artifacts with SHA256SUMS.
- Record UTC timestamps and stable ordering in logs.
- Avoid external network calls unless explicitly permitted.
- Keep links to the relevant specs and schemas for verification.

Operational evidence
- Replay verification logs
- Policy decision evidence bundles
- Incident timelines and postmortems

Related references
- docs/operations/*
- docs/airgap/*