RAGcore-Public/runbooks/INCIDENT.md

Incident Runbook

Triage

Identify trace IDs, affected workspace/application/space, component health and whether confidentiality, integrity or availability is affected. Preserve evidence and avoid logging sensitive content.

Containment examples

• Revoke service credential/session.
• Disable application, source, knowledge space or model profile.
• Stop workers while keeping search read-only where safe.
• Revert Qdrant alias to previous validated build.
• Block connector egress or quarantine source.

Recovery

Use authoritative PostgreSQL/blobs/artifacts, reconciliation, tested backup/restore and golden/security gates. Never declare recovery based only on container health.

Post-incident

Timeline, root cause, affected data, controls, tests, backlog remediation and credential/model/index rotations as needed.