std

Tier
V — owned by the catalog, last confirmed 2026-09-01
Why
std is the catalog's own namespace. There is nobody to prove that to, so this one does not lapse.
Records
16

Reaching tier S

  1. Prove control of the source. A DNS TXT record on the domain, or ownership of the GitHub organisation the records come from. The namespace is claimed, not granted.
  2. Keep proving it. Verification is rechecked. A tier granted once and never revisited survives a domain expiring into somebody else's hands.
  3. For tier S, publish a signing key. An ed25519 key at /.well-known/runbooks-attestation-keys.json, and records signed with it. A signature is what makes a record resistant to substitution after publication, and it is the prerequisite for trust T3. A key that is retired or revoked still verifies what it signed and no longer earns the tier.
  4. And two people approve it. The promotion to tier S is approved by two different maintainers (§15), recorded in the registry beside the verification. Nothing about your key or your records is enough on its own.

Attestations

Nothing here has been attested. T2 is what the catalog checks on its own; T3 needs somebody to run a procedure and sign for it, and nobody has.

Records

a-failed-look-is-not-a-quiet-week

Make a scheduled send tell an empty period from a failed look, so a broken source does not mark everybody served and defer them to the next run.

Publisher
std tier V
Targets
postgres
Highest risk
reversible-write
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

ci-refuses-to-start-deploy-by-hand

The pipeline refuses a run before it starts, so the deploy has to happen from a workstation — told apart from a real failure first, and with what the manual path costs put back afterwards.

Publisher
std tier V
Targets
github-actions, terraform, aws
Highest risk
irreversible
Execution
human-only
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

confirm-an-action-in-a-browser-you-drive

Establish whether an action in somebody else's web interface actually happened, when a stale success looks like a fresh one and an open form looks like a failure.

Publisher
std tier V
Targets
linux
Highest risk
reversible-write
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

decide-where-a-model-is-needed

Measure what rules can extract from a corpus before paying a model to read all of it, and tell a rule that is weak from a corpus that is silent.

Publisher
std tier V
Targets
postgres
Highest risk
reversible-write
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

disk-pressure-triage

Find what is filling a volume before deciding whether to delete anything, so the deletion is informed rather than hopeful.

Publisher
std tier V
Targets
linux
Highest risk
read-only
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

enrich-from-pages-you-do-not-control

Fill fields from pages somebody else serves, at volume, without recording a guess as a fact or a refusal as an answer.

Publisher
std tier V
Targets
linux
Highest risk
reversible-write
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

flaky-check-retry-budget

Poll a condition that is slow to settle, and give up on a schedule instead of waiting indefinitely.

Publisher
std tier V
Targets
linux
Highest risk
read-only
Execution
agent-autonomous
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

k8s-node-not-ready-drain

Drain a node stuck NotReady and reschedule its pods, after establishing whether the kubelet is gone or merely unreachable.

Publisher
std tier V
Targets
k8s
Highest risk
destructive
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

kafka-consumer-group-stuck-restart

Restart a consumer group that has stopped advancing its offsets, after confirming the lag is real and not a monitoring artefact.

Publisher
std tier V
Targets
kafka
Highest risk
reversible-write
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

one-worker-for-a-single-session-credential

Run an integration whose credential is one account session without losing that session — a second worker on the same key reads as a hijack, and the key does not come back.

Publisher
std tier V
Targets
aws
Highest risk
irreversible
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

postgres-drop-stale-replication-slot

Drop a replication slot that is pinning WAL and filling the disk, after confirming nothing is consuming it.

Publisher
std tier V
Targets
postgres
Highest risk
destructive
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

prove-a-read-only-credential-cannot-write

Confirm that a database role handed to an agent actually refuses writes, by the permission check rather than by an error that happened to arrive first.

Publisher
std tier V
Targets
postgres
Highest risk
read-only
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

publish-through-a-browser-already-signed-in

Post to a platform that has no usable API by driving a browser a person signed into by hand, and check the result as a stranger rather than as the author.

Publisher
std tier V
Targets
linux
Highest risk
reversible-write
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

put-an-item-on-a-public-feed

Publish one item to a feed strangers read, with the address assigned once by the server and kept even after the item comes off again.

Publisher
std tier V
Targets
postgres
Highest risk
reversible-write
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

separate-people-from-automation-in-traffic

Make a rate mean something by counting a denominator every response passes through and a signal only a person can produce, without joining the two.

Publisher
std tier V
Targets
postgres
Highest risk
reversible-write
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory

verify-a-listing-against-its-source

Check an entry against the page its subject publishes, not the aggregator that carried it, and write down only what that page actually said.

Publisher
std tier V
Targets
postgres
Highest risk
reversible-write
Execution
human-with-agent
Profile
P1
Trust
T2 · 2026-10-11 · runbooks.directory