Triage and recover on-call operations

Map failure classes for PagerDuty schedule ai-answer-primary: retryable vs fatal vs needs-human. Retries need budgets, jitter, and idempotency rules aligned to missed ACK in 15m escalates; SEV1 pages dual; handoff includes timeline + next action. The chapter’s signature failure — everyone paged for SEV3 noise → real SEV1 ignored — must take a deliberate branch, not a generic catch-all.

Implement the degrade/rollback/refuse behavior primary engineer receiving SEV2 after hours needs when INC-OC-554 repeats. Prefer scoped controls (one flag, one weight, one tenant, one secret version) over fleet-wide restarts. Preserve evidence; do not delete logs to “clean the demo.”

After containment, check ack_minutes and pages_per_week moves in the safe direction and watch for retry amplification. Write the stop condition that ends the incident response for this lab.

Chaos note: inject only one fault class at a time and restore fixtures after. Watch for dual failures — dependency down and retry amplifier — which is how everyone paged for SEV3 noise → real SEV1 ignored becomes an outage. Customer communication templates (even if only for the drill) beat silence. If you queue deferred work, define poison-message handling. Budget documents should state the maximum extra spend allowed during retries. Close the loop by linking the containment action to a dashboard panel for ack_minutes and pages_per_week.

Draw a state diagram for degrade modes and put it in the repo as ASCII if needed. Cap concurrent retries across the process, not only per request. Ensure cancellation propagates to downstream HTTP clients. When failing closed, choose a user-visible message that does not leak internals. Practice the single command that flips the kill switch or weight to zero. After recovery, drain or inspect deferred work before declaring green. In this chapter the product is humane escalation path for production AI answer platform, the human stakeholder is primary engineer receiving SEV2 after hours, and the incident id you design against is INC-OC-554. Re-state the oracle in your notes — game day: primary misses ACK → secondary owns INC-OC-554 in 15m with access grant — and keep the invariant visible: missed ACK in 15m escalates; SEV1 pages dual; handoff includes timeline + next action. Track ack_minutes and pages_per_week as the scoreboard. Surface under change control: PagerDuty schedule ai-answer-primary. If you only have forty minutes, finish the fixture for everyone paged for SEV3 noise → real SEV1 ignored before polishing UI. Promotion language stays ternary: promote, hold, or roll back based on evidence, not hope.