# Runbooks

Operational runbooks per ARCH-21 (Incident Response Standard) §6.

**Format.** Every runbook is a signed, versioned markdown file with:
```
Runbook: <slug>
Version: <semver>
Owner: <team>
Depends on: <engines, keys, capabilities>
Preconditions:
Steps:
  1. <action> — expected outcome — verification
Rollback:
Post-checks:
Time budget:
Escalation:
Change log:
```

Runbook execution goes through Kernel-mediated capabilities (ARCH-21 D-21-3). Every step is audited; no shell-out bypass.

**Drilling.** Cadence per ARCH-51 (Recovery Exercise Framework) and ARCH-49 (Tabletop). "Last drilled" ≤ 90 d for standard, ≤ 30 d for Kernel-critical. Stale drills raise SEV-3 alarms (ARCH-21 M-21a).

**Categories** (from ARCH-21 §7):
- KernelIntegrityAlarm, WatchdogQuorumFailure, AuditChainGap, RedactionFailure, CapabilityAnomaly, PluginMisbehavior, RansomwareOnRuntime, KMSCompromise, ProviderTrustDrop, AIHallucinationTrend, DataResidencyBreach.

Runbooks authored during ARCH-59 Phase 5.