Write the Admin Operations and Incident Response Runbook

[codebestia]

Document the routine and emergency operations the protocol admin performs day to day — fee changes, token listing, merchant status changes, role management — and the incident response procedure when something goes wrong.

Proposed steps:

• Create docs/operations/admin-runbook.md.
• Document routine procedures with exact commands and verification steps: changing a fee via propose_fee/execute_fee, listing and de-listing tokens, activating/deactivating and verifying merchants, granting and revoking roles, and rotating the platform account.
• Document the admin key custody policy, approval requirements, and change-log expectations for every privileged action.
• Document the incident response procedure: detection signals, the decision criteria for pausing, the pause execution steps, triage and diagnosis using on-chain reads and events, remediation options, and the criteria for unpausing.
• Document severity levels with target response times and the escalation path.
• Document the post-incident process: timeline reconstruction from events, merchant communication, and remediation follow-ups.
• Cross-link the pausable, admin transfer, upgrade runbook, and threat model documents.

Acceptance criteria:

• docs/operations/admin-runbook.md exists.
• Every routine admin procedure is documented with commands and verification.
• The incident response flow covers detection, pause decision, triage, remediation, and unpause criteria.
• Severity levels, escalation, and the post-incident process are defined.

[achebejohnpaul]

Am a full-Stack Engineer focused on frontend, backend, APIs, automation, and modern web technologies. Passionate about solving real-world problems, contributing to open source, and delivering clean, scalable, review-ready solutions.