Incident learning テンプレート

このページは、記入用テンプレートを誤ってサイトのメタデータとして解釈しないよう、原文をコードとして表示しています。

原本をダウンロード

---
schema: codex-delivery/incident@1
document_id: "INC-<<required: YYYYMMDD-sequence>>"
change_id: "CHG-<<required: newly issued incident-response bundle ID>>"
risk_tier: "<<required: incident-response bundle R0 | R1 | R2 | R3>>"
originating_change_ids:
  - "<<required: originating CHG ID or UNKNOWN>>"
document_status: active
decision_state: STOP
owner: "<<required: incident owner>>"
evidence_as_of: "<<required: ISO 8601>>"
commit_sha: "<<required: deployed source SHA or UNKNOWN>>"
supersedes: N/A — incident events are append-only
refs:
  - REL-<<required: release ID or UNKNOWN>>
---

# Incident learning record: <<required: factual short title>>

Use this for security, privacy, billing, data, availability, AI/tool-effect, or customer-impact incidents. Separate facts from hypotheses; do not assign blame.

## Identity and current state

- Severity: `SEV0 | SEV1 | SEV2 | SEV3`
- Severity definition/runbook version: `<<required: path/ID/hash defining impact, response, and time expectations; do not assume universal ordering>>`
- Incident-response `change_id` / originating change IDs: `<<required: response bundle / known IDs or UNKNOWN>>`
- Incident state: `detected | triaged | contained | eradicated | recovered | learning | closed | reopened`
- Detected / declared / contained / recovered: `<<required or UNKNOWN>>`
- Incident commander / technical / customer / legal-security owners: `<<required; one person may hold several roles>>`
- Affected product/environment/region: `<<required>>`
- Release/artifact/config/model/runtime-authority fingerprints: `<<required or UNKNOWN: include IaC, identity/IAM, DB role/RLS/grants, credential ID-version-scope, egress when applicable>>`
- External ticket/provider/regulator refs: `<<required or N/A with reason>>`

## Release and evidence invalidation

Opening an incident creates an append-only invalidation event. It never edits an earlier release event, but it prevents reuse of the affected `SHIP` decision.

| Invalidation event | Affected release manifest/stage/cohort | REL/EVAL/TM/PR gates invalidated | Rollout/automation stopped | Reason/evidence | Actor/time | State |
|---|---|---|---|---|---|---|
| INC-INV-01 | <<required or UNKNOWN>> | <<required: IDs or all pending scope>> | <<required>> | <<required>> | <<required>> | active/superseded/closed |

- Uncertain affected manifests/stages: `<<required or none; UNKNOWN prevents expansion>>`
- Release-system open-incident gate updated at/evidence: `<<required>>`
- New manifest/evidence/approval required to resume: `<<required>>`

An open incident affecting a manifest, its provenance, control, or observation invalidates the applicable release gate. Prior approval cannot resume rollout. Reopening requires a new release manifest or a positively proven unchanged safe subset, rerun gates, and a fresh scope-bound approval event.

## Known impact

| Dimension | Confirmed | Possible/unknown | Evidence/cutoff |
|---|---|---|---|
| Accounts/users/jobs | <<required>> | <<required>> | <<required>> |
| Data/confidentiality/integrity | <<required>> | <<required>> | <<required>> |
| Money/billing/refund | <<required>> | <<required>> | <<required>> |
| Availability/work stopped | <<required>> | <<required>> | <<required>> |
| External effects | <<required>> | <<required>> | <<required>> |
| Legal/contract/notification | <<required>> | <<required>> | <<required>> |
| Founder recovery/support time | <<required>> | <<required>> | <<required>> |

Do not write `no impact` when the scope or observation window is unknown.

## Facts, hypotheses, and non-facts

### Confirmed facts

- `<<required: timestamped fact with evidence ID>>`

### Active hypotheses

- `<<required: hypothesis, falsifying evidence, owner>>`

### Ruled out

- `<<required: claim and evidence that ruled it out, or none yet>>`

## Timeline

Append by occurrence/effective time; do not reorder history to match discovery time.

| Occurred/effective at | Observed/recorded at | Event/fact | Actor/system | Evidence | Decision/action |
|---|---|---|---|---|---|
| <<required>> | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> |

## Evidence preservation

- Logs/traces/audit/query snapshots: `<<required>>`
- Artifact/config/schema/model/prompt/runtime-authority hashes: `<<required: include IaC, identity/IAM, DB role/RLS/grants, credential IDs/versions/scopes, egress; never secret values>>`
- Chain of custody/access/redaction: `<<required>>`
- Data retention/deletion hold: `<<required or N/A with reason>>`
- Missing evidence and why: `<<required>>`

Do not copy secrets, payment data, or unnecessary personal/customer content into this document.

## Containment and recovery

| Action | Type | Owner | Started/completed | Result/post-condition | Evidence | Reversible? |
|---|---|---|---|---|---|---:|
| <<required>> | flag / key revoke / isolate / rollback / restore / refund / correction / notification | <<required>> | <<required>> | <<required>> | <<required>> | yes/no |

- Blast-radius limit used: `<<required>>`
- Rollback/compensation failures: `<<required or none with evidence>>`
- Customer workaround/manual fallback: `<<required or N/A>>`
- Recovery verification and maturity: `<<required>>`

## Communication and notification

| Audience/authority | Trigger/requirement | Owner | Due/sent | Approved content ref | Evidence |
|---|---|---|---|---|---|
| affected customer | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> |
| provider/insurer/professional | <<required or N/A>> | <<required>> | <<required>> | <<required>> | <<required>> |
| regulator/law enforcement | <<required or N/A with professional confirmation>> | <<required>> | <<required>> | <<required>> | <<required>> |

This template is not legal advice. Use the applicable contract, law, official guidance, and professional advice for notification decisions.

## Causal analysis

### Direct mechanism

`<<required: how the unsafe state/effect occurred>>`

### Contributing conditions

| Layer | Condition | Evidence | Why existing control did/did not stop it |
|---|---|---|---|
| Requirement/product scope | <<required>> | <<required>> | <<required>> |
| Architecture/code/data | <<required>> | <<required>> | <<required>> |
| Test/eval/review | <<required>> | <<required>> | <<required>> |
| Release/config/permission | <<required>> | <<required>> | <<required>> |
| Monitoring/response | <<required>> | <<required>> | <<required>> |
| Process/capacity/provider | <<required>> | <<required>> | <<required>> |

Avoid a single “human error” root cause. Ask which system condition made the action possible, invisible, or hard to recover.

### Defenses that worked

- `<<required>>`

### Counterfactual

- Earliest practical control that would have prevented or limited impact: `<<required>>`
- Evidence that the proposed control addresses this mechanism: `<<required>>`

## Corrective actions

Prefer the strongest practical control; a reminder alone is weak.

| Action ID | Control layer | Action | Owner | Due | Verification evidence | State | Expiry/reopen trigger |
|---|---|---|---|---|---|---|---|
| ACT-01 | scope / code / DB / test / lint / CI / AGENTS / threat / eval / runbook / monitor | <<required>> | <<required>> | <<required>> | <<required>> | proposed/in_progress/verified/accepted_risk | <<required>> |

For every critical/high action, record a regression test/eval case or explain why it cannot be created and name an alternative control.

## Knowledge updates

| Artifact | Old gap | Update ID/path | Verification | Owner |
|---|---|---|---|---|
| Task/AC | <<required>> | <<required>> | <<required>> | <<required>> |
| ADR/threat baseline | <<required>> | <<required>> | <<required>> | <<required>> |
| Test/eval case | <<required>> | <<required>> | <<required>> | <<required>> |
| AGENTS/CI/hook | <<required>> | <<required>> | <<required>> | <<required>> |
| Runbook/monitor/support | <<required>> | <<required>> | <<required>> | <<required>> |

## Closure and reopening

- Impact window mature: `yes/no — due <<required>>`
- Recovery verified: `yes/no — evidence <<required>>`
- Critical/high actions verified: `yes/no — IDs`
- Administrative-closure High exceptions: `<<required: policy + authority + exact scope + expiry + rationale + reopen trigger, or none; forward re-SHIP remains PAUSE>>`
- Non-waivable/active residual Critical: `<<required: 0, otherwise closure and re-SHIP forbidden>>`
- Residual risk accepted by/at/scope/expiry/rationale: `<<required or N/A>>`
- Closure decision / actor / time: `<<required>>`
- Reopen triggers: `<<required>>`
- Follow-up remediation change IDs and risk tiers: `<<required>>`
- New release manifest / fresh approval IDs for any resumed stage: `<<required or not resumed>>`

`closed` means material corrective actions have verified effect and the impact/incident observation window is mature. A non-waivable veto or active residual Critical cannot be accepted into closure or re-SHIP. An active residual High may permit administrative incident closure only under an applicable formal policy with recorded authority, scope, expiry, rationale, and reopen trigger; it still keeps forward deploy/release/exposure at `PAUSE` until mitigation or scope reduction lowers it below High. “Fix merged” alone is not closure. Reopening adds a new event and preserves the old conclusion.