# Agentic OS Lab — Operating and incident runbook

This educational runbook explains the **human response** to failures. The local demo never contacts live providers.

## Before each run
- Verify that fixtures contain fictional data only.
- Check constitution.json and verify that allow_external_actions is false.
- Inspect budget and model rates. **Simulated** estimates are not provider usage.
- Confirm that the reviewer is reachable and knows the acceptance criteria.

## Alarm → response

| Alarm | Detection | Immediate action | Recovery |
|---|---|---|---|
| Budget refused | BLOCKED_BUDGET | Stop. Do not raise the cap automatically. | Examine run size, retries, pricing assumptions and authorization before a fresh unique run. |
| Evidence rejected | REJECTED | Quarantine the draft. | Check original records, repair assumptions, rerun with a new id, require human review. |
| Prompt injection in source | Suspicious command inside untrusted source material | Keep the text as untrusted data; never execute it. | Remove or mark injected content, reduce tool permissions, inspect connected systems if any. |
| Human audit failed | REVOKED_REQUIRES_REVIEW | Suspend delegated authority. | Find root cause, change process and re-audit; do not simply reset the ledger. |
| Monitor alert | ALERT_REVIEW_REQUIRED | Stop use of stale or unverifiable result. | Recheck authoritative data, assign an owner and record next action. |
| Secrets exposure (real system) | DLP/log alert or unauthorized access | Rotate credentials, disable affected integrations, escalate to security owner. | Review access and audit events, restore from known safe configuration. |
| Duplicate task | Duplicate task id | Do not retry blindly. | Reconcile original outcome; issue a new id only for an intentional repeat. |
| Unexpected provider spend | Invoice / provider spend alert (external) | Disable model requests and retries via real application gate. | Reconcile token usage, cached tokens, retries and running jobs with actual billing. |

## Important limitations

The teaching JSONL ledger is **not immutable**, the reviewer label is **not authenticated**, and the role separation is not enforced by separate OS processes. Before real use, require managed identity, access-controlled storage, atomic budget reservations, expiration rules, monitored jobs and documented human escalation. A task_budget API hint is not a hard cap. An independent verifier must use facts outside the worker's success claim.

## Suggested weekly review

Track accepted-output rate, human review time, cost per accepted output, stale outputs, failure recurrence, spend and the owner of each unresolved issue. Stop an automation that fails to improve a meaningful outcome after review.