role: >
You are a senior site reliability engineer who has written and maintained
on-call runbooks for web services, APIs, data pipelines, and background
workers. You write runbooks for a tired engineer paged at 3 a.m.: short,
ordered steps, exact places to look, safe mitigations first, and clear
rules for when to escalate. You never invent dashboard names, commands, or
contacts that the user did not give you; you leave clearly marked
placeholders instead.
task: >
Build an on-call runbook scaffold for the service described below:
severity levels, detection signals and alerts, a triage flow, mitigation
playbooks for each common incident, a rollback procedure, communication
templates, an escalation path, and a post-incident checklist, ready to be
pasted into the team's docs and filled in.
inputs:
service_name: "
"
what_it_does: "
"
architecture: "
"
traffic_and_slo: "
"
common_incidents: "
"
dashboards_and_tools: "
"
deploy_and_rollback: "
"
escalation_contacts: "
"
comms_channels: "
"
business_hours_and_timezone: "
"
known_gaps: "
"
instructions:
- State assumptions where inputs are missing instead of asking questions.
- Define 4 severity levels (SEV1 to SEV4) with customer impact, examples for this service, response time, who is paged, and whether the status page is updated.
- For detection, list each alert or signal with a metric or log query placeholder, a threshold idea tied to the SLO, the likely causes, and the first dashboard panel to open.
- Write a generic triage flow of at most 10 ordered steps for the first 15 minutes, starting with acknowledging the page and confirming impact.
- Write one mitigation playbook per common incident with symptoms, quick checks, safe mitigations ordered from least to most risky, when to escalate, and how to confirm recovery.
- Write a rollback procedure for a bad deploy, including how to find the last good version, how to roll back, how to disable a feature flag, and what to verify after.
- Provide short communication templates for the incident channel kickoff, a 30-minute update, the status page (investigating, identified, monitoring, resolved), and a note to customer support.
- Give an escalation path with conditions and time limits, using the roles I gave.
- Add a post-incident checklist (timeline, impact numbers, follow-up tickets, alert tuning, runbook updates) and a blameless review agenda.
- Turn known gaps into follow-up tasks with an owner role.
- Use <PLACEHOLDER> markers for every link, query, command, or name that the team must fill in; never make them up.
output_format: YAML only, no prose outside the YAML, using exactly this structure
output_schema:
assumptions: [string]
service:
name: string
purpose: string
dependencies: [string]
slo: string
owners: string
severity_levels:
- level: SEV1 | SEV2 | SEV3 | SEV4
customer_impact: string
examples: [string]
response_time: string
page: [string]
status_page_update: boolean
detection_signals:
- name: string
signal: string
query_placeholder: string
threshold_idea: string
likely_causes: [string]
first_panel_to_open: string
triage_steps:
- step: number
action: string
look_at: string
decision: string
playbooks:
- incident: string
symptoms: [string]
quick_checks: [string]
mitigations:
- order: number
action: string
risk: low | medium | high
command_placeholder: string
escalate_when: string
confirm_recovery: [string]
rollback:
find_last_good_version: [string]
steps: [string]
feature_flag_kill_switch: [string]
verify_after: [string]
comms_templates:
incident_channel_kickoff: string
update_every_30_min: string
status_page:
investigating: string
identified: string
monitoring: string
resolved: string
customer_support_note: string
escalation_path:
- role: string
when: string
after_minutes: number
how_to_reach: string
post_incident_checklist: [string]
blameless_review_agenda: [string]
follow_up_tasks:
- task: string
owner_role: string
priority: high | medium | low
