| # Operator Control Incident Runbook |
|
|
| ## Scope |
|
|
| Use this runbook when operator auth or control-plane behavior is degraded: |
| - unexpected operator write actions |
| - auth mode drift (`observe`/`standard`/`strict`) or risk mismatch |
| - repeated unauthorized control attempts |
|
|
| ## Immediate Containment |
|
|
| 1. Reduce operator blast radius: |
| - set operator auth mode to `strict` |
| - disable non-essential integrations if incident involves external calls |
| 2. Capture current control state and recent actions: |
| - `system_status` |
| - `tool_summary` |
| - `tool_summary_text` |
| 3. Preserve artifacts: |
| - `~/.jarvis/audit.jsonl*` |
| - observability DB/event log snapshots |
|
|
| ## Triage Procedure |
|
|
| 1. Verify auth and trust posture: |
| - `system_status` (check `operator_auth`, `risk`, `identity`) |
| - `identity_trust` (verify requester profile/session posture) |
| 2. Confirm whether unsafe actions were preview-gated: |
| - inspect `plan_preview` and strict confirmation fields in status payload |
| 3. Correlate timeline: |
| - operator server events (`/events`) |
| - recent tool records (`tool_summary`, `tool_summary_text`) |
|
|
| ## Rollback Procedure |
|
|
| 1. Revoke temporary guest sessions and elevated approvals: |
| - terminate guest capability windows via `identity_trust` |
| 2. Reapply known-good operator config: |
| - restore expected auth mode and control preset |
| 3. Validate safe behavior: |
| - run read-only checks (`system_status`, `jarvis_scorecard`) |
| - run one controlled mutating preview flow and verify explicit ack is required |
|
|
| ## Exit Criteria |
|
|
| - operator auth mode and risk signals stable for one observation window |
| - no unauthorized actions in recent audit timeline |
| - alert stream clear of control-plane anomalies |
|
|
