Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

runbooks/INCIDENT.md

@@ -0,0 +1,21 @@
+# Incident Runbook
+
+## Triage
+
+Identify trace IDs, affected workspace/application/space, component health and whether confidentiality, integrity or availability is affected. Preserve evidence and avoid logging sensitive content.
+
+## Containment examples
+
+- Revoke service credential/session.
+- Disable application, source, knowledge space or model profile.
+- Stop workers while keeping search read-only where safe.
+- Revert Qdrant alias to previous validated build.
+- Block connector egress or quarantine source.
+
+## Recovery
+
+Use authoritative PostgreSQL/blobs/artifacts, reconciliation, tested backup/restore and golden/security gates. Never declare recovery based only on container health.
+
+## Post-incident
+
+Timeline, root cause, affected data, controls, tests, backlog remediation and credential/model/index rotations as needed.