# Runbook — {service}

Owner (the person who types, not the person who wrote this): {name}
Last executed: {YYYY-MM-DD} by {name} — result: pass / fail
Time budget: deploy {N} min · rollback {N} min

A runbook that has not been executed on production is a draft.
If a step only exists in someone's head, that step is the afternoon's work.

---

## 1. Deploy

From a merged commit to production traffic.

### Preconditions

- [ ] You can open the repo, the pipeline, and the production dashboard without asking for a login.
- [ ] The previous known-good digest is written below, copied from the last successful deploy, not from memory.

Previous known-good digest: `{sha256:…}`

### Steps

1. Open `{path-to-service}` on `main`. Confirm the merge is the one you intend to ship.
2. Pipeline: `{ci-url}`. Wait for `{blocking-jobs}` to go green. Do not skip `{policy-job}`.
3. Promote the **digest**, not a tag. Command or click:

   ```
   {promote-command-or-ui}
   ```

4. Watch `{dashboard-url}` for `{N}` minutes. Abort if `{abort-criteria}` (error rate, latency, saturation — the same signals the alert uses).
5. Write the new digest here, and in `{where-digests-live}`:

   Shipped digest: `{sha256:…}`

### Proof it worked

Production reflects the change: `{how-you-see-it}` (a version endpoint, a canary label, a log line). A green pipeline is not this proof.

---

## 2. Rollback

One command, the previous known-good digest, and what a rollback does **not** fix.

### Command

```
{rollback-command}
```

Expected time to previous traffic: `{N}` minutes.

### What rollback does not undo

- Migrations already applied: `{none | list}`
- Messages already consumed: `{none | list}`
- Feature flags already flipped: `{none | list}`

If any of those is not `none`, rollback is not the whole recovery. Write the extra step here, or this runbook is lying.

### Proof it worked

Traffic is on the previous digest. `{how-you-see-it}`.

---

## 3. If this runbook cannot be followed

Stop. Do not invent. The drill failed. Write which step you could not do, with the error, in `{docs/handover/drill-log.md}`.
That note is the finding. Fixing it is the next working day, with the vendor still in the room — not after they have left.