Turn the incident timeline into the runbook for the next one
What somebody worked out at 3am, written down before it is forgotten.
The ticket
Convert an incident timeline into a runbook a different person could follow.
Acceptance criteria
- Every step names the dashboard, query, or command it needs
- Each step has been run and confirmed to work
- It states how to tell whether the step worked
- It is linked from the alert that would fire for this again
What lands as proof
Every command and link in the runbook exercised, so it is verified rather than remembered.
Why teams defer it
- The person who resolved it has the context and the least appetite to write it up.
- A week later the details have gone, and what gets written is a summary rather than a procedure.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: convert an incident timeline into a runbook a different person could follow. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means each step verified against the real dashboards and commands, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.