# 建立 SRE 事件知識庫

這是三個檔案的虛構桌上演練：用唯讀觀察整理積壓，遵守中止上限，並把原因保持為待驗證假設。

## 任務

只根據三個來源檔，整理觀察到的積壓影響，提出有時間與取樣上限的唯讀觀察計畫，並分開假設與必須由事件負責人決定的事項。每個結論都用 [[filename]] 引用。

## 預期推理

把 8.6% 的 5xx、1.8 秒 p95 與 420 的佇列深度記為觀察；遵守 15 分鐘、三個畫面、20 行資料的限制；遇到變更操作或暴露敏感資料就中止；把 09:05 部署視為待比對的關聯假設，而非已證明的原因。

## 完整來源資料包

### Northstar API — tabletop observations — incident-observations.md

```markdown
# Northstar API — tabletop observations

Status: fictional teaching observation sheet; no live service or customer data is involved.

At 09:10 UTC, the alert window showed 8.6% HTTP 5xx responses and 1.8 seconds p95 latency for the Northstar API. The normal reference window in this exercise is 0.4% 5xx and 350 milliseconds p95. Queue depth was 420 items; the reference value is 40.

These are observations, not a root-cause finding. This packet contains no customer identifiers, raw logs, or evidence of a particular deployment causing the change.
```

### Read-only tabletop triage guardrails — read-only-triage.md

```markdown
# Read-only tabletop triage guardrails

The responder may inspect the incident dashboard, a redacted log sample, and the deployment timeline. The observation window is at most 15 minutes, with at most three views and 20 redacted log rows. Record timestamps and observed values; do not turn correlation into causation.

Do not restart a service, change configuration, invalidate a cache, roll back a release, acknowledge a customer action, or write to an incident system. Abort immediately if a view requests a mutation, exposes an unredacted identifier or secret, or cannot show whether its data is fictional and redacted.

A human incident owner decides whether to escalate, page another team, or authorize a change.
```

### Northstar API — fictional deployment timeline — deploy-timeline.md

```markdown
# Northstar API — fictional deployment timeline

A cache-configuration deployment completed at 09:05 UTC. The incident alert began at 09:10 UTC. The timeline records those two times but does not contain a causal test, rollback approval, or owner decision.

The five-minute ordering makes the deployment a hypothesis to compare against read-only observations. It does not prove that the deployment caused the 5xx responses or latency. Rollback eligibility and the responsible owner are not specified in this packet.
```

## Reference answer: observe within limits, preserve uncertainty

The exercise supports a bounded read-only backlog observation: compare the alert values with the reference window, inspect only the named redacted views, and abort on mutation, secrets, or unredacted identifiers. The 09:05 deployment is a temporal hypothesis, not a proven cause; escalation, rollback, and ownership remain human decisions.

# Northstar API — triage reference

## Observed state

The fictional alert window records 8.6% 5xx, 1.8 seconds p95 latency, and queue depth 420, compared with reference values of 0.4%, 350 milliseconds, and 40. These are observations and do not establish a root cause. [[incident-observations.md]]

## Safe observation plan

A responder may inspect the incident dashboard, one redacted log sample, and the deployment timeline for at most 15 minutes, three views, and 20 redacted rows. The responder records timestamps and values only. Any requested mutation, unredacted identifier or secret, or unclear fictional/redaction status is an abort condition. [[read-only-triage.md]]

## Hypothesis and human decisions

The cache-configuration deployment completed at 09:05 UTC, five minutes before the alert. That makes it a candidate correlation to compare, not proof of causation. The packet does not authorize a rollback, identify an owner, or decide whether to escalate; a human incident owner must make those decisions. [[deploy-timeline.md]] [[read-only-triage.md]]

## 變更後來源

### deploy-timeline.md

```markdown
# Northstar API — fictional deployment timeline, revision 2

A cache-configuration review was recorded at 09:05 UTC, but it made no production change. The cache-configuration deployment completed at 09:15 UTC, after the incident alert began at 09:10 UTC. The timeline still contains no causal test, rollback approval, or owner decision.

The corrected ordering removes this deployment as an explanation for the alert onset. Other causes remain unknown. Rollback eligibility and the responsible owner are not specified in this packet.
```

## 變更預期

The reference's statement that the 09:05 deployment was a candidate cause becomes stale. The 09:05 event was only a review and the actual deployment followed the alert, so it cannot explain the initial onset. The read-only limits, observed values, and human decisions about escalation or rollback remain unchanged; the incident cause is still unknown.

## 審查邊界

核對觀察數值、15 分鐘／三個畫面／20 行上限、中止條件與時間先後；升級、回滾和負責人仍由事件負責人判斷。

## 比較

單一桌上演練資料可以手動複核。當觀察、假設、中止規則與後續時間線修正需要保持連結，又不能把筆記變成操作授權時，來源連結的事件 wiki 才有幫助。

## 閱讀本地化頁面

https://wenlan.app/zh-TW/learn/build-sre-incident-knowledge-base