How the playbook is built: skeleton, evidence, risk model, catalogue gates
Every incident page follows the same 13 sections. Each incident type needs accepted public reports from at least two organisations, one from the last 5 years. Grades are computed by script from those reports. Catalogue entries reach an incident page only through their own documentation.
The incident page skeleton
- Title: the incident name with symptoms, cause and the test that catches it
- Direct answer: definition, likelihood and impact labels, count of public reports, verification date
- Symptoms: user-visible and monitoring-visible lines, each with an evidence number
- Root causes: two to four causes, each with the pipeline stage where it is introduced
- Public examples: every accepted primary and secondary report with organisation, date, summary, grade and link
- Test classes that catch it: one to three classes with stage, limitation and basis label
- Risk: likelihood and impact grades with the counts behind them
- Pre-release checklist: five to ten items, each naming its test class
- First 30 minutes: five to eight items for detection, containment, rollback decision and customer communication
- Catalogue entries: tools and providers whose own documentation names those test classes, alphabetical
- Only on this page: a fact no other page carries
- Related incidents: three to five, from shared group, stage or test class
- Questions and disclaimer
Cited and by design analysis
A link between an incident and a test class is labelled "cited in [n]" when report [n] on that page names the class.
Every other link is labelled "by design analysis": it follows from what the class is built to catch and the cause the reports describe, and it is the author's reasoning.
Root causes with no report stating them carry the same label.
Evidence
Reports are graded primary, secondary or practitioner. Each URL is loaded and a verbatim passage is matched before a report counts; a second review checks that the report describes a change-caused instance of the incident definition. Evidence classes, freshness and rejections
Risk model
Likelihood counts recent public reports; impact follows the impact class the reports state. Scales and formula
Catalogue gates
Tools: public documentation names at least one test class; a pricing page or licence file exists; a dated release within 18 months; every fact has a source URL and a verification date.
Providers: software testing is a standalone service on the provider's own site; the site names a delivery country; a second source confirms founding year and headquarters country; a dated page within 12 months.
Neither catalogue carries ratings, review scores, logos or recommendations. Listings are alphabetical.
Withheld routes
Questions
How is the playbook built?
Every incident page follows a fixed 13-section skeleton. Evidence is collected per incident, verified by loading each URL, and graded. Risk grades are computed by script from the accepted evidence.
What counts as evidence for an incident page?
Primary: the affected organisation's post-mortem, a status page record with a root cause, a regulator or court finding, or a repository issue whose maintainers mark the root cause. Secondary: a third-party analysis linking a primary source, or a recorded talk by the affected team. Practitioner: write-ups without a specific dated incident, used for symptoms and checklists only.
What are the criteria for an incident type to get its own page?
An incident type is published only when at least two organisations have an accepted, dated public report of it, with at least one report from the last 5 years.
What do the evidence grades mean?
Primary and secondary reports can back any section and count toward the two-source rule. Practitioner sources back symptoms and checklists only and never count toward it.
How are likelihood and impact grades calculated?
Likelihood: 6 or more recent public reports is high, 3 to 5 medium, 2 low. Impact: the majority stated impact class; data, money or compliance is high, availability medium, degraded low; fewer than 2 stated impacts is unrated.
What are the limits of the likelihood and impact grades?
The grades do not weight by company size, industry or opinion and produce no single score. Time-to-detection values above the 95th percentile are kept in evidence and excluded from group medians.