Incident Response
Incident Response
Provide evidence-based incident investigation and recovery guidance.
Status: Partial implementation reference — Code-confirmed; operational validation pending
Last reviewed: 2026-10-19
Scope
Triage, escalation, diagnosis, mitigation, recovery verification and follow-up practices. The source-confirmed baseline below covers part of this scope; remaining operational details are unknown.
Current implementation baseline
For rejected writes, distinguish credential failure, onboarding 428, maintenance 503, payload/schema validation and an uncertain downstream outcome. Preserve the original operation token and payload for uncertain retries; generating a new logical operation can duplicate a contribution. See errors and retries.
For lineage failures, stop guessing cursors and use the Corpus identity/recovery runbook. It requires independent configuration, fenced traffic and fresh lineage for restore/reset. For archive gaps, compare committed history with verified certificate/object coverage; a stored maximum or status report is insufficient.
Events can republish after queue acceptance followed by cursor-save failure. MCP queue acceptance does not prove listener receipt; recover complete client state through canonical synchronization. Evidence: event pump, MCP queue handler and backup limitations. On-call ownership, alert thresholds and a tested production incident drill remain undocumented.
