# 建立 SRE 事件知识库

这是三个文件的虚构桌面演练：用只读观察整理积压，遵守中止上限，并把原因保留为待验证假设。

## 任务

只根据三个来源文件，整理观察到的积压影响，提出有时间和取样上限的只读观察计划，并区分假设与必须由事件负责人决定的事项。每个结论都用 [[filename]] 引用。

## 预期推理

把 8.6% 的 5xx、1.8 秒 p95 和 420 的队列深度记为观察；遵守 15 分钟、三个视图、20 行数据的限制；遇到变更操作或暴露敏感数据就中止；把 09:05 部署视为待比对的关联假设，而不是已证明的原因。

## 完整来源资料包

### Northstar API — tabletop observations — incident-observations.md

```markdown
# Northstar API — tabletop observations

Status: fictional teaching observation sheet; no live service or customer data is involved.

At 09:10 UTC, the alert window showed 8.6% HTTP 5xx responses and 1.8 seconds p95 latency for the Northstar API. The normal reference window in this exercise is 0.4% 5xx and 350 milliseconds p95. Queue depth was 420 items; the reference value is 40.

These are observations, not a root-cause finding. This packet contains no customer identifiers, raw logs, or evidence of a particular deployment causing the change.
```

### Read-only tabletop triage guardrails — read-only-triage.md

```markdown
# Read-only tabletop triage guardrails

The responder may inspect the incident dashboard, a redacted log sample, and the deployment timeline. The observation window is at most 15 minutes, with at most three views and 20 redacted log rows. Record timestamps and observed values; do not turn correlation into causation.

Do not restart a service, change configuration, invalidate a cache, roll back a release, acknowledge a customer action, or write to an incident system. Abort immediately if a view requests a mutation, exposes an unredacted identifier or secret, or cannot show whether its data is fictional and redacted.

A human incident owner decides whether to escalate, page another team, or authorize a change.
```

### Northstar API — fictional deployment timeline — deploy-timeline.md

```markdown
# Northstar API — fictional deployment timeline

A cache-configuration deployment completed at 09:05 UTC. The incident alert began at 09:10 UTC. The timeline records those two times but does not contain a causal test, rollback approval, or owner decision.

The five-minute ordering makes the deployment a hypothesis to compare against read-only observations. It does not prove that the deployment caused the 5xx responses or latency. Rollback eligibility and the responsible owner are not specified in this packet.
```

## Reference answer: observe within limits, preserve uncertainty

The exercise supports a bounded read-only backlog observation: compare the alert values with the reference window, inspect only the named redacted views, and abort on mutation, secrets, or unredacted identifiers. The 09:05 deployment is a temporal hypothesis, not a proven cause; escalation, rollback, and ownership remain human decisions.

# Northstar API — triage reference

## Observed state

The fictional alert window records 8.6% 5xx, 1.8 seconds p95 latency, and queue depth 420, compared with reference values of 0.4%, 350 milliseconds, and 40. These are observations and do not establish a root cause. [[incident-observations.md]]

## Safe observation plan

A responder may inspect the incident dashboard, one redacted log sample, and the deployment timeline for at most 15 minutes, three views, and 20 redacted rows. The responder records timestamps and values only. Any requested mutation, unredacted identifier or secret, or unclear fictional/redaction status is an abort condition. [[read-only-triage.md]]

## Hypothesis and human decisions

The cache-configuration deployment completed at 09:05 UTC, five minutes before the alert. That makes it a candidate correlation to compare, not proof of causation. The packet does not authorize a rollback, identify an owner, or decide whether to escalate; a human incident owner must make those decisions. [[deploy-timeline.md]] [[read-only-triage.md]]

## 变更后来源

### deploy-timeline.md

```markdown
# Northstar API — fictional deployment timeline, revision 2

A cache-configuration review was recorded at 09:05 UTC, but it made no production change. The cache-configuration deployment completed at 09:15 UTC, after the incident alert began at 09:10 UTC. The timeline still contains no causal test, rollback approval, or owner decision.

The corrected ordering removes this deployment as an explanation for the alert onset. Other causes remain unknown. Rollback eligibility and the responsible owner are not specified in this packet.
```

## 变更预期

The reference's statement that the 09:05 deployment was a candidate cause becomes stale. The 09:05 event was only a review and the actual deployment followed the alert, so it cannot explain the initial onset. The read-only limits, observed values, and human decisions about escalation or rollback remain unchanged; the incident cause is still unknown.

## 审核边界

核对观察数值、15 分钟／三个视图／20 行上限、中止条件和时间先后；升级、回滚和负责人仍由事件负责人判断。

## 对比

单个桌面演练资料可以手动复核。当观察、假设、中止规则和后续时间线修正需要保持关联，又不能把笔记变成操作授权时，来源链接的事件 wiki 才有帮助。

## 阅读本地化页面

https://wenlan.app/zh-CN/learn/build-sre-incident-knowledge-base