Incident Response Cell

Description and use

Triages service failures, preserves evidence and coordinates bounded recovery with rollback readiness.

Roles and handoffs

Incident Commander

Triages service failures, preserves evidence and coordinates bounded recovery with rollback readiness.

Produces a reviewed evidence bundle and a bounded next action.

Quality Owner

Checks provenance, permissions, unsupported claims and completion evidence.

Approves the run or returns exact blockers to the operator.

Agents

Runtime Observer

Triages service failures, preserves evidence and coordinates bounded recovery with rollback readiness.

Codex or Hermes

• browser
• terminal
• approved APIs

Policy Reviewer

Keeps mutations, publication and external delivery human-gated.

Codex

• audit log
• policy checks

Environment requirements

WORKSPACE_API_TOKEN

Optional scoped token for the explicitly selected workspace.

Skills

• systematic-debugging
• service-rollout

Runtime assumptions

• Run in an isolated workspace with least-privilege credentials.
• Persist checkpoints and audit receipts for every mutation.

Safety notes

• Never embed or export secrets.
• Do not enable write, payment, deployment or publishing actions without explicit approval.

Setup steps

• Review roles, tools and data boundaries.
• Connect read-only sources first.
• Run a bounded canary before enabling scheduled work.

Import instructions

• Copy this config into a draft workspace.
• Map tools manually and review every requested permission.
• Add secrets only in the runtime secret store.