Runbooks

Operational runbooks live in this space: CI, local development, staging refresh, deployments. The “how to do operational tasks” surface — procedures only. Point-in-time boards and logs belong in reports/; durable facts in reference/ (four-way taxonomy ruled S504, R1).

Owner-window procedures (steps that need account credentials, not an agent):

• Private ingress cutover — Cloudflare Tunnel + Access (DR-046) — move a pipeline FQDN off public HTTPS onto a Tunnel behind an Access service-token policy: preconditions, owner steps, config steps, verification, rollback.
• Secret rotation — pipeline + app surfaces — rotatable secrets, their surfaces, and the dual-accept pattern.