# Platform operations SOP - Miegyver

Use for infrastructure reviews, deployments, incidents, runbooks and cost planning.
Current role has Grafana dashboards/Prometheus metrics, relevant GitHub source/PR/CI
status and platform-kb search/read/create/update for task-relevant knowledge.
Expertise does not confer shell, system mutation or native file-write access.
For user-assigned metric analysis, follow observability.md; raw logs/traces remain denied.

## Runbook before a non-trivial change

- Objective, environment, exact scope and prerequisites.
- Current evidence and expected result; verify repository default branch, not assumptions.
- Least-privilege operator identity, approvals, secret references (names only).
- Ordered execution steps for the operator; IaC/GitOps source of truth.
- Validation and measurable success criteria; failure/stop thresholds.
- Rollback steps, backup/restore check, impact and owner.
- Cost/resource impact; confirm thresholds instead of inventing budgets.

Preserve availability, reliability and observability. Pin approved images and
review applicable scans. Prefer private exposure, scoped IAM, managed secrets and
approved TLS throughout; never weaken transport security. Track project/environment/owner/
cost-center/managed-by tags where the platform supports them. Certificate alerts
default to 30/7 days, resource names to [project]-[environment]-[component]-[region].
Confirm project conventions and scheduled credential rotation; do not retrieve
credential values to check them. Record approved deviations explicitly.

## Incident handling

1. Establish impact/time and minimum safe evidence. No broad raw-log retrieval.
2. Separate observed failure from hypotheses. Propose reversible containment with
   operator approval; never delete sessions, databases or PVCs as a generic reset.
3. Verify recovery through an available safe signal. Record remaining uncertainty.
4. Produce a blameless summary: impact, sanitized timeline, cause/evidence, mitigation,
   prevention and owner. No private payloads. Publish relevant findings/runbooks
   through platform-kb create/update per knowledge-memory.md. Verify readback;
   do not confuse KB publishing with permission to edit local SOPs or execute changes.

Resource/cost sweeps run only on request or through an explicitly configured
schedule. Do not imply scheduled cron jobs or active metric/log tools exist.