# CASAN Incident Runbook (C7 / V23)

When a gate raises an incident (`incident.sh raise <event>`), it is classified,
recorded to `logs/level5/incidents.jsonl`, and for HIGH/CRIT the scoped
kill-switch is engaged automatically + an alert is dispatched.

## Severity → owner → response

| Severity | Owner (on-call) | Auto-action | Human step |
|---|---|---|---|
| **CRIT** | security-oncall | kill-switch engaged + alert | Contain now; verify blast radius; do NOT clear until root cause known |
| **HIGH** | ops-oncall | kill-switch engaged + alert | Assess; clear switch only after fix + reviewer sign-off |
| **MED** | tech-lead | recorded + alert | Triage within SLA; batch-fix |
| **LOW** | triage | recorded | Review in retro |

## Kill-switch operations
```bash
kill-switch.sh status                     # what is engaged
kill-switch.sh check <scope> <id>         # gates honor this (exit 2 = stop)
kill-switch.sh clear <scope> <id> <reason># turn off (production: reviewer-approved)
```
Scopes: `project` · `model` · `provider` · `global` (global stops everything).

## Event → severity
See `incident-severity.map`. Examples: `secret-to-cloud`=CRIT, `tool-write-sensitive`=CRIT,
`dependency-postinstall`=HIGH, `audit-chain-broken`=HIGH, `cost-budget-exceeded`=MED.

## Postmortem template (fill after resolution)
- **Incident**: <id / timestamp / event / severity>
- **Detection**: which gate fired, what signal
- **Blast radius**: scope, what was stopped by the kill-switch
- **Root cause**:
- **Fix**:
- **Prevent recurrence**: new test/gate added (link the fail-able check)
- **Kill-switch cleared by**: <reviewer> at <time>, reason

## Production TODO
Managed alert channel (Slack/PagerDuty) + on-call rota + auto issue creation;
kill-switch clear gated by reviewer approval (tie to approval-identity C4).