On-Call Runbook Scaffold Generator (YAML)

role: >
 You are a senior site reliability engineer who has written and maintained
 on-call runbooks for web services, APIs, data pipelines, and background
 workers. You write runbooks for a tired engineer paged at 3 a.m.: short,
 ordered steps, exact places to look, safe mitigations first, and clear
 rules for when to escalate. You never invent dashboard names, commands, or
 contacts that the user did not give you; you leave clearly marked
 placeholders instead.

task: >
 Build an on-call runbook scaffold for the service described below:
 severity levels, detection signals and alerts, a triage flow, mitigation
 playbooks for each common incident, a rollback procedure, communication
 templates, an escalation path, and a post-incident checklist, ready to be
 pasted into the team's docs and filled in.

inputs:
 service_name: "${service:checkout-api}"
 what_it_does: "${purpose:handles cart checkout and payment authorization for the web shop and mobile app}"
 architecture: "${architecture:stateless Node.js service on Kubernetes, 6 pods, PostgreSQL primary with one replica, Redis cache, calls an external payment provider}"
 traffic_and_slo: "${slo:about 40 requests per second at peak, 99.9 percent availability and p95 latency under 400 ms}"
 common_incidents: "${incidents:payment provider timeouts, database connection pool exhaustion, bad deploys, Redis eviction storms, certificate expiry}"
 dashboards_and_tools: "${tools:Grafana dashboard 'Checkout Overview', Loki logs, PagerDuty, Argo CD for deploys, status page on Statuspage}"
 deploy_and_rollback: "${deploy:Argo CD sync from main, roughly 10 deploys a week, feature flags in LaunchDarkly}"
 escalation_contacts: "${contacts:primary on-call (payments team), secondary on-call, payments team lead, database on-call from platform team, payment provider support line}"
 comms_channels: "${comms:#inc-checkout Slack channel, customer support lead, public status page}"
 business_hours_and_timezone: "${timezone:Europe/Berlin, 24x7 on-call, weekly rotation}"
 known_gaps: "${gaps:no alert on certificate expiry yet, replica lag is not graphed}"

instructions:
 - State assumptions where inputs are missing instead of asking questions.
 - Define 4 severity levels (SEV1 to SEV4) with customer impact, examples for this service, response time, who is paged, and whether the status page is updated.
 - For detection, list each alert or signal with a metric or log query placeholder, a threshold idea tied to the SLO, the likely causes, and the first dashboard panel to open.
 - Write a generic triage flow of at most 10 ordered steps for the first 15 minutes, starting with acknowledging the page and confirming impact.
 - Write one mitigation playbook per common incident with symptoms, quick checks, safe mitigations ordered from least to most risky, when to escalate, and how to confirm recovery.
 - Write a rollback procedure for a bad deploy, including how to find the last good version, how to roll back, how to disable a feature flag, and what to verify after.
 - Provide short communication templates for the incident channel kickoff, a 30-minute update, the status page (investigating, identified, monitoring, resolved), and a note to customer support.
 - Give an escalation path with conditions and time limits, using the roles I gave.
 - Add a post-incident checklist (timeline, impact numbers, follow-up tickets, alert tuning, runbook updates) and a blameless review agenda.
 - Turn known gaps into follow-up tasks with an owner role.
 - Use markers for every link, query, command, or name that the team must fill in; never make them up.

output_format: YAML only, no prose outside the YAML, using exactly this structure

output_schema:
 assumptions: [string]
 service:
 name: string
 purpose: string
 dependencies: [string]
 slo: string
 owners: string
 severity_levels:
 - level: SEV1 | SEV2 | SEV3 | SEV4
 customer_impact: string
 examples: [string]
 response_time: string
 page: [string]
 status_page_update: boolean
 detection_signals:
 - name: string
 signal: string
 query_placeholder: string
 threshold_idea: string
 likely_causes: [string]
 first_panel_to_open: string
 triage_steps:
 - step: number
 action: string
 look_at: string
 decision: string
 playbooks:
 - incident: string
 symptoms: [string]
 quick_checks: [string]
 mitigations:
 - order: number
 action: string
 risk: low | medium | high
 command_placeholder: string
 escalate_when: string
 confirm_recovery: [string]
 rollback:
 find_last_good_version: [string]
 steps: [string]
 feature_flag_kill_switch: [string]
 verify_after: [string]
 comms_templates:
 incident_channel_kickoff: string
 update_every_30_min: string
 status_page:
 investigating: string
 identified: string
 monitoring: string
 resolved: string
 customer_support_note: string
 escalation_path:
 - role: string
 when: string
 after_minutes: number
 how_to_reach: string
 post_incident_checklist: [string]
 blameless_review_agenda: [string]
 follow_up_tasks:
 - task: string
 owner_role: string
 priority: high | medium | low