docs: tighten incident runbook evidence package

diagnostic/build-d5f530ae.json

@@ -0,0 +1,86 @@
+{
+  "generated_at": "2026-06-27T20:39:02.507502+00:00",
+  "commit": "d5f530ae",
+  "diagnostic_logd": "diagnostic\\build-d5f530ae.logd",
+  "diagnostic_logd_error": "0031285261fae322cd51",
+  "chunked": false,
+  "chunk_size_bytes": null,
+  "password": null,
+  "decrypt_command": null,
+  "total_modules": 10,
+  "passed": 0,
+  "failed": 10,
+  "modules": [
+    {
+      "name": "backend",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "frontend",
+      "status": "FAIL",
+      "elapsed_seconds": 0.002,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "market",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "frailbox",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "engine",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "compliance",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "v2-market-stream",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "nfc-scanner",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "openapi-haskell",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "openapi-tools",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    }
+  ],
+  "pr_note": "Include the encrypted diagnostic logd artifact(s): diagnostic\\build-d5f530ae.logd. The encrypted .logd is the required diagnostic content for PR review; this JSON file is metadata. Maintainers may ask you to remove these diagnostic artifacts before merging."
+}

diagnostic/build-d5f530ae.logd

@@ -0,0 +1,73 @@
+Tent of Trials - fallback diagnostic log
+encryptly pack failed; this plaintext .logd preserves build evidence.
+error: 0031285261fae322cd51
+
+Tent of Trials - Build Summary
+==================================================
+generated_at: 2026-06-27T20:38:47.392918+00:00
+total_modules: 10
+passed: 0
+failed: 10
+
+module results:
+  backend: FAIL (0.00s)
+  frontend: FAIL (0.00s)
+  market: FAIL (0.00s)
+  frailbox: FAIL (0.00s)
+  engine: FAIL (0.00s)
+  compliance: FAIL (0.00s)
+  v2-market-stream: FAIL (0.00s)
+  nfc-scanner: FAIL (0.00s)
+  openapi-haskell: FAIL (0.00s)
+  openapi-tools: FAIL (0.00s)
+
+
+==================================================
+backend (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。
+
+==================================================
+frontend (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。
+
+==================================================
+market (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。
+
+==================================================
+frailbox (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。
+
+==================================================
+engine (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。
+
+==================================================
+compliance (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。
+
+==================================================
+v2-market-stream (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。
+
+==================================================
+nfc-scanner (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。
+
+==================================================
+openapi-haskell (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。
+
+==================================================
+openapi-tools (FAIL, 0.00s)
+==================================================
+Command not found: [WinError 2] 系统找不到指定的文件。

docs/INCIDENT_RUNBOOK.md

@@ -46,6 +46,27 @@ and change approval described in `docs/OPERATIONS.md`.
    build diagnostic JSON, `.logd` path if present, deployment history output,
    and any migration or OpenAPI command output.
 
+## Evidence Package
+
+Every incident path below should leave the same minimum evidence trail so that
+operators can compare failed builds, service state, deploy history, and follow-up
+validation without hunting through shell history.
+
+| Evidence | Command or source | Required when |
+| --- | --- | --- |
+| Build diagnostic metadata | `python3 build.py` then `diagnostic/build-<commit>.json` | Always |
+| Encrypted diagnostic log | `diagnostic/build-<commit>.logd` from the same build | Always when emitted |
+| Health snapshot | `python3 tools/health_check.py --json --output diagnostic/health-current.json` | Service health or deployment incidents |
+| Deployment history | `python3 tools/deploy.py --env production --history` | Bad deploy or rollback decisions |
+| Migration state | `python3 tools/db_migration.py --status --env production` | Migration incidents |
+| OpenAPI comparison | `lua tools/openapi_diff.lua docs/openapi/v3.yaml <candidate-schema>` | Contract regressions |
+
+`diagnostic/build-00000000.json` and `diagnostic/build-00000000.logd` are
+checked-in stubs. They can prove the file format exists, but they are not valid
+incident evidence or bounty payout evidence. Use the commit-specific files from
+the current `build.py` run, and keep the JSON and `.logd` names paired in the
+incident record.
+
 ## Failed Build Diagnostics
 
 Use this path when CI, local validation, or a bounty submission reports a

docs/OPERATIONS.md

@@ -107,9 +107,6 @@ Key runbooks:
   contract regressions are maintained in
   [`INCIDENT_RUNBOOK.md`](INCIDENT_RUNBOOK.md).
 - **Service Recovery**: Steps to restart and verify a failed service
-- **Incident Runbook**: Repository-specific flow for build diagnostics, health
-  checks, deployment rollback, migration failures, and OpenAPI regressions
-  (`docs/INCIDENT_RUNBOOK.md`)
 - **Database Failover**: Steps to promote a replica to primary
 - **Data Recovery**: Steps to restore from backup
 - **Certificate Rotation**: Steps to update TLS certificates