# Incident Runbook

## Triage

Identify trace IDs, affected workspace/application/space, component health and whether confidentiality, integrity or availability is affected. Preserve evidence and avoid logging sensitive content.

## Containment examples

- Revoke service credential/session.
- Disable application, source, knowledge space or model profile.
- Stop workers while keeping search read-only where safe.
- Revert Qdrant alias to previous validated build.
- Block connector egress or quarantine source.

## Recovery

Use authoritative PostgreSQL/blobs/artifacts, reconciliation, tested backup/restore and golden/security gates. Never declare recovery based only on container health.

## Post-incident

Timeline, root cause, affected data, controls, tests, backlog remediation and credential/model/index rotations as needed.