{
  "dataset": "corrobore-durable-runtime-incident",
  "version": "1.0.0",
  "description": "An ordered incident remediation trail, used as a workload that must survive interruption and resume without duplication.",
  "license": "CC0-1.0",
  "generated_by": "corrobore-website/usecases/durable-runtime.mjs",
  "facts": {
    "checkpoints": 13,
    "crash_after_step": 6,
    "phases": 6,
    "duplicate_writes_tolerated": 0
  },
  "memories": [
    {
      "identity_key": "incident--pipeline-2291",
      "kind": "ops.incident",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Unsigned artifact push on the release pipeline, opened after automated correlation.",
          "properties": {
            "severity": "high",
            "ticket": "INC-2291"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "pipeline"
      ]
    },
    {
      "identity_key": "step--01-triage",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Alert correlated: three build hosts pushed unsigned artifacts within four minutes.",
          "properties": {
            "ordinal": 1,
            "phase": "triage"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/1",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "triage"
      ]
    },
    {
      "identity_key": "step--02-scope",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Blast radius scoped to the release pipeline; production clusters not reached.",
          "properties": {
            "ordinal": 2,
            "phase": "scope"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/2",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "scope"
      ]
    },
    {
      "identity_key": "step--03-contain-1",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Pipeline service account disabled at the identity provider.",
          "properties": {
            "ordinal": 3,
            "phase": "contain"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/3",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "contain"
      ]
    },
    {
      "identity_key": "step--04-contain-2",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Outbound egress rule added for the build subnet, pending review.",
          "properties": {
            "ordinal": 4,
            "phase": "contain"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/4",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "contain"
      ]
    },
    {
      "identity_key": "step--05-collect-1",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Build host disk images queued for acquisition.",
          "properties": {
            "ordinal": 5,
            "phase": "collect"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/5",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "collect"
      ]
    },
    {
      "identity_key": "step--06-collect-2",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Pipeline audit log exported for the seventy-two hours preceding the first push.",
          "properties": {
            "ordinal": 6,
            "phase": "collect"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/6",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "collect"
      ]
    },
    {
      "identity_key": "step--07-analyse-1",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Unsigned artifacts traced to a single credential replayed from an unfamiliar autonomous system.",
          "properties": {
            "ordinal": 7,
            "phase": "analyse"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/7",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "analyse"
      ]
    },
    {
      "identity_key": "step--08-analyse-2",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "No evidence of lateral movement beyond the build subnet at this point.",
          "properties": {
            "ordinal": 8,
            "phase": "analyse"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/8",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "analyse"
      ]
    },
    {
      "identity_key": "step--09-remediate-1",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "All pipeline secrets rotated; new signing key issued under dual control.",
          "properties": {
            "ordinal": 9,
            "phase": "remediate"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/9",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "remediate"
      ]
    },
    {
      "identity_key": "step--10-remediate-2",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Artifact signature verification made a hard gate rather than a warning.",
          "properties": {
            "ordinal": 10,
            "phase": "remediate"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/10",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "remediate"
      ]
    },
    {
      "identity_key": "step--11-verify-1",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Replayed the last seven releases against the new gate; two failed and were rebuilt.",
          "properties": {
            "ordinal": 11,
            "phase": "verify"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/11",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "verify"
      ]
    },
    {
      "identity_key": "step--12-verify-2",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Egress rule narrowed after review; temporary rule removed.",
          "properties": {
            "ordinal": 12,
            "phase": "verify"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/12",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "verify"
      ]
    },
    {
      "identity_key": "step--13-close",
      "kind": "ops.checkpoint",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Incident closed with two follow-up actions tracked outside the pipeline.",
          "properties": {
            "ordinal": 13,
            "phase": "close"
          }
        }
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/13",
          "observed_at": null
        }
      ],
      "confidence": 0.95,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "incident",
        "checkpoint",
        "close"
      ]
    }
  ],
  "relationships": [
    {
      "identity_key": "rel--incident-step--01-triage",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--01-triage",
      "kind": "records",
      "properties": {
        "ordinal": 1
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/1",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--02-scope",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--02-scope",
      "kind": "records",
      "properties": {
        "ordinal": 2
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/2",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--02-scope",
      "source_key": "step--01-triage",
      "target_key": "step--02-scope",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/1",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--03-contain-1",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--03-contain-1",
      "kind": "records",
      "properties": {
        "ordinal": 3
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/3",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--03-contain-1",
      "source_key": "step--02-scope",
      "target_key": "step--03-contain-1",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/2",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--04-contain-2",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--04-contain-2",
      "kind": "records",
      "properties": {
        "ordinal": 4
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/4",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--04-contain-2",
      "source_key": "step--03-contain-1",
      "target_key": "step--04-contain-2",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/3",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--05-collect-1",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--05-collect-1",
      "kind": "records",
      "properties": {
        "ordinal": 5
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/5",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--05-collect-1",
      "source_key": "step--04-contain-2",
      "target_key": "step--05-collect-1",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/4",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--06-collect-2",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--06-collect-2",
      "kind": "records",
      "properties": {
        "ordinal": 6
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/6",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--06-collect-2",
      "source_key": "step--05-collect-1",
      "target_key": "step--06-collect-2",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/5",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--07-analyse-1",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--07-analyse-1",
      "kind": "records",
      "properties": {
        "ordinal": 7
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/7",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--07-analyse-1",
      "source_key": "step--06-collect-2",
      "target_key": "step--07-analyse-1",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/6",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--08-analyse-2",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--08-analyse-2",
      "kind": "records",
      "properties": {
        "ordinal": 8
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/8",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--08-analyse-2",
      "source_key": "step--07-analyse-1",
      "target_key": "step--08-analyse-2",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/7",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--09-remediate-1",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--09-remediate-1",
      "kind": "records",
      "properties": {
        "ordinal": 9
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/9",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--09-remediate-1",
      "source_key": "step--08-analyse-2",
      "target_key": "step--09-remediate-1",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/8",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--10-remediate-2",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--10-remediate-2",
      "kind": "records",
      "properties": {
        "ordinal": 10
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/10",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--10-remediate-2",
      "source_key": "step--09-remediate-1",
      "target_key": "step--10-remediate-2",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/9",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--11-verify-1",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--11-verify-1",
      "kind": "records",
      "properties": {
        "ordinal": 11
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/11",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--11-verify-1",
      "source_key": "step--10-remediate-2",
      "target_key": "step--11-verify-1",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/10",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--12-verify-2",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--12-verify-2",
      "kind": "records",
      "properties": {
        "ordinal": 12
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/12",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--12-verify-2",
      "source_key": "step--11-verify-1",
      "target_key": "step--12-verify-2",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/11",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--incident-step--13-close",
      "source_key": "incident--pipeline-2291",
      "target_key": "step--13-close",
      "kind": "records",
      "properties": {
        "ordinal": 13
      },
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/step/13",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--follows-step--13-close",
      "source_key": "step--12-verify-2",
      "target_key": "step--13-close",
      "kind": "precedes",
      "properties": {},
      "provenance": [
        {
          "source_id": "oncall-runbook",
          "locator": "incident#2291/order/12",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    }
  ]
}