| name | sre-runbooks |
| description | Safe-by-default DevOps/SRE runbook automation for incident response, postmortems, on-call handovers, and operational troubleshooting. Implements Google SRE principles with agent-safe execution patterns including dry-run modes, human approval gates, and blast-radius limits. |
| version | 1.0.0 |
| platforms | ["openclaw","claude","codex","cursor","gemini","copilot","opencode","windsurf"] |
| author | {"name":"Skill Foundry (Forge)","source":"Google SRE Book, bregman-arie/devops-sre-skills, Pulumi DevOps Skills"} |
| license | MIT |
| risk_tier | L2 |
| tags | ["devops","sre","incident-response","runbook","postmortem","on-call","troubleshooting"] |
| requires | {"binaries":[]} |
SRE Runbooks
Production-safe DevOps and SRE runbook automation. Execute incident response
procedures, draft postmortems, generate on-call handovers, and troubleshoot
production issues — all with built-in safety gates that prevent the agent
from making destructive changes without human approval.
When to Use This Skill
Use this skill when:
- Responding to a production incident (alert fired, service degraded)
- Writing or updating a runbook for a service
- Drafting a postmortem after an incident
- Preparing on-call handover notes
- Troubleshooting a deployment failure or pipeline issue
- Performing a root cause analysis (RCA)
- Any request like "investigate this alert", "write a postmortem",
"create runbook for X", "prepare handover notes"
Safety Model
This skill is risk tier L2 (elevated). Every automated action follows
these safety rules:
Execution Gates
| Gate | Description |
|---|
| Read-only first | All investigations start read-only; writes require explicit escalation |
| Dry-run by default | Destructive commands print what they would do before execution |
| Blast-radius check | Before acting, compute and report the scope of impact |
| Human approval | Any change to production state requires human confirmation |
| Rollback plan | Every change proposal includes a verified rollback path |
| Audit log | Every action is logged with timestamp, identity, and justification |
Never-Automate List
These actions require a human in the loop, no exceptions:
kubectl delete on running workloadsterraform destroy or terraform apply -auto-approve- Database DROP, TRUNCATE, or schema-destructive migrations
- DNS record deletion or apex domain changes
- IAM policy or RBAC role removal
- Secrets rotation without backup verification
- Firewall rule removal on production traffic paths
Incident Response Workflow
Phase 1: Triage (Read-Only)
When an alert fires, the agent:
