Operate / Incident commanders

Incident response

Contain a proof, identity, settlement, ownership, or availability incident without erasing evidence or rewriting admitted truth.

verified history and containmentincident register, canonical verifier, and scoped conformanceComplete production checklist

Implementation rail · incident register, canonical verifier, and scoped conformance

Exact execution and operator checks

01
Operator check
Contain and preserve
Stop the affected mutation path, preserve exact artifacts and rejected receipts, name the first failing invariant, owner, scope, and operation identity, and keep verified local truth readable.
Substantive records: /trust/exceptions · /reference/operations-receipts
Expected: Evidence is preserved before correction.

Exact mechanic

Verify preserved bytes

import { createReceizClient } from "@receiz/sdk";

const encoded = process.env.RECEIZ_ARTIFACT_BASE64;
if (!encoded) throw new Error("RECEIZ_ARTIFACT_BASE64 is required");
const artifactBytes = Uint8Array.from(Buffer.from(encoded, "base64"));
const receiz = createReceizClient();
const verification = await receiz.verification.verifyArtifact(artifactBytes);
if (verification.status !== "verified-artifact") throw new Error(verification.status);
console.log(verification.status);

Mechanic: receiz.verification.verifyArtifact
Authentication and account boundary: Account-free local verification; incident authority remains with law and held proof.
Exact source: node_modules/@receiz/sdk/dist/index.d.ts · SHA-256 3278d551808697d9936ffdf75931358c903bb0cc5a211191b611d4474895f6be

Expected: The held artifact produces an exact accepted or rejected status.

03
Exact mechanic
Run governance:evidence-check
```
pnpm governance:evidence-check
```
Mechanic
pnpm governance:evidence-check
Authentication and account boundary
Authorized local repository checkout; the command proves only the checked repository boundary.
Exact source
package.json · SHA-256 132f99232dfaf26f7186b73752938d1377042808f42d60d374fe7b2e57c7646b
Expected: Incident evidence satisfies the committed evidence contract.
04
Operator check
Append correction and close
Correct through a verified append from the last admitted proof head, rerun the primitive-specific suite, and close only with owner, verification, and recovery evidence.
Substantive records: /trust/conformance · /trust/governance
Expected: The correction extends history without erasing the incident.

Complete operating anatomy

Every boundary required to ship.

Solved outcome: The incident is classified, contained, preserved, recomputed, corrected through verified append, and closed with exact evidence.
Prerequisites: Hold the incident owner, primitive-risk label, affected operation identities, last verified proof heads, exact artifacts and receipts, first failing invariant, containment authority, and communication boundary.
Exact primitive: verified history and containment
Governing law: Incident response is governed by authority-boundaries: Assigned control custody remains separated by recorded boundary. exception-register: The active set and historical set remain visibly disclosed; a future deviation is recorded with its exact identifier rather than represented as passing truth. governance-evidence: Registered evidence entries satisfy the checker's exact presence, binding, and status rules.
Source-of-truth order: Receiz law → sealed artifact truth → deterministic proof object state → verified durable local or register truth → authenticated snapshot → server distribution, synchronization, indexing, and publication → database, session, observability, and interface projections.
Expected artifact, receipt, or state: An incident record containing scope, first failing invariant, preserved artifacts, containment action, corrective append, verification, owner, and closure evidence.
Inspection: Inspect the incident timeline, affected proof heads, rejected checks, custody actions, and exception status. Inspection exposes structure and receipt fields; inspection never establishes verification.
Independent verification: Independent verification for incident-response: run the canonical verifier and the conformance suite for the affected primitive. This establishes only the verified history and containment boundary named by the bound sources; The implementation rail remains beneath proof authority: incident register, canonical verifier, and scoped conformance.
Offline behavior: Preserve local artifacts and continue local verification. Queue only evidence appends that cannot be published during the outage.
Identity and account boundary: Public Record Moment, Seal File, Verify, Export, and public proof reading are account-free. Identity is optional and adds continuity, custody, recovery, and governed private controls after proof admission.
Security boundary: Revoke or rotate only keys proven exposed; preserve forensic bytes; never paste secrets into tickets, logs, or Academy tooling.
Conformance command: pnpm governance:check && pnpm governance:evidence-check
Deployment checks: Prepare incident access, immutable evidence custody, primitive-specific conformance, key revocation, mutation kill switches, local-proof continuity, verified correction append, and closure evidence before an incident occurs.
Production checklist: Classify precisely; stop the affected mutation; preserve bytes; verify held artifacts; rotate only proven-exposed credentials; append correction from the last verified head; run affected conformance; close with owner and evidence.
Rollback and containment: Containment for incident-response: Root-cause and proof history become incomplete. Preserve remaining artifacts and record the evidence gap explicitly. The response creates a first-paint and truth-downgrade regression. Restrict only the affected mutation path and restore read/verify access. Historical truth is downgraded. Create a verified corrective append from the last admitted head. Preserve every stronger held artifact and admitted state while the named boundary is corrected.

Fail closed

Mutation and failure matrix

Evidence is altered or deleted during containment.

Effect: Root-cause and proof history become incomplete.
Retry: Do not reconstruct missing bytes as originals.
Recovery: Preserve remaining artifacts and record the evidence gap explicitly.

Containment blocks reading verified local truth.

Effect: The response creates a first-paint and truth-downgrade regression.
Retry: Do not keep the blanket block.
Recovery: Restrict only the affected mutation path and restore read/verify access.

A correction replaces instead of appends to the verified head.

Effect: Historical truth is downgraded.
Retry: Reject the replacement.
Recovery: Create a verified corrective append from the last admitted head.

Exact authority

Claim-to-source bindings

Assigned control custody remains separated by recorded boundary.
docs/governance/control-boundaries.v1.mdnormative-governance · SHA-256 da31636848c373e8d54e8d101885e15a9a29f7f8a734cf5fe675b7e7d5ec166e
The active set and historical set remain visibly disclosed; a future deviation is recorded with its exact identifier rather than represented as passing truth.
docs/governance/exception-log.v1.mdexception-register · SHA-256 9957d60dbf833f2881475aece133e72349e3f5b2df891d27b6462cbe39af2a84
Registered evidence entries satisfy the checker's exact presence, binding, and status rules.
scripts/check_governance_evidence.tsevidence-register · SHA-256 4d887a3943808bec1f3d274b02bd4cf7cfc9f3b39c5e34169c709ddc97c8263c

One complete system

Exact execution and operator checks

Contain and preserve