Lilith Operator Console Action Runbooks — Lilith Metaverse

runbook-set: v3-operator-console-actions.v1 owner: Lilith Operations

Every action below has an expected SLA and a verification command. Operators must record the action id in the audit event before closing the case.

Actions#

Owner: Lilith-Safety
Trigger: room health, report queue, or launch-decision dashboard enters attention state.
SLA: acknowledge within 2 minutes; first mitigation within 5 minutes.
Steps: open the room dashboard, confirm tenant and region, inspect active reports, check Pixel Streaming POP health, assign commander when multi-team work is needed.
Rollback: return room routing to the previous capacity policy after green telemetry for 10 minutes.
Escalation: incident commander, Pixel Streaming on-call, then Lilith-Safety lead.
Audit event: operator.live_room_dashboard.triaged
Verification: pnpm verify:v3 lilith-live-room-dashboard

Owner: Lilith-Safety
Trigger: credible abuse, room overload, or host absence.
SLA: acknowledge within 90 seconds; complete takeover within 4 minutes.
Steps: lock room mutations, assign operator host, publish user-facing banner, preserve evidence bundle, and hand back only after the incident commander approves.
Rollback: unlock room mutations and remove the banner after safety review.
Escalation: Lilith-Safety lead, incident commander, then legal/privacy owner if evidence includes protected data.
Audit event: operator.room_takeover.completed
Verification: pnpm verify:v3 lilith-room-takeover

Owner: Saraswati Editorial
Trigger: concert schedule moves from draft to publish review.
SLA: review within 1 business day; hotfix schedule within 30 minutes.
Steps: validate region availability, ticket policy, recording consent model, pre-warm reservation, C2PA recording plan, and operator coverage.
Rollback: unpublish calendar entry and notify ticket holders through the incident communication template.
Escalation: Saraswati Editorial lead, Commerce lead, then release captain.
Audit event: operator.concert_calendar.approved
Verification: pnpm verify:v3 lilith-concert-calendar-approval

Owner: Tara Editorial
Trigger: instructor submits or updates credentials.
SLA: review within 2 business days; minor-facing corrections within 4 hours.
Steps: verify credentials, background-check state, liability insurance, lineage display, voice consent, and minor-safety eligibility.
Rollback: suspend instructor publishing and remove minor-facing availability.
Escalation: Tara Editorial lead, minor-safety reviewer, then legal owner.
Audit event: operator.instructor_verification.reviewed
Verification: pnpm verify:v3 lilith-instructor-verification-queue

Owner: Lilith-Editorial Ops
Trigger: generation provider outage, policy hold, or queue age breach.
SLA: acknowledge within 5 minutes; route failover within 15 minutes.
Steps: inspect queued jobs, compare policy verdicts, move blocked jobs to editorial review, and route eligible jobs to the approved failover provider.
Rollback: restore primary provider after the provider health gate is green for 30 minutes.
Escalation: generation provider owner, Lilith-Editorial Ops lead, then release captain for launch-blocking queues.
Audit event: operator.generation_queue.inspected
Verification: pnpm verify:v3 lilith-generation-queue-inspector

Owner: Lilith-Rights
Trigger: rights request, contributor withdrawal, or policy adjudication.
SLA: acknowledge within 4 business hours; urgent takedown within 1 hour.
Steps: validate claimant, freeze affected artifact, execute takedown cascade, update C2PA/provenance references, and notify impacted customers.
Rollback: restore artifact only after adjudication reversal and provenance repair are complete.
Escalation: Lilith-Rights lead, Isis Provenance owner, then legal owner.
Audit event: operator.takedown.executed
Verification: pnpm verify:v3 lilith-takedown-executor

Owner: Isis Provenance
Trigger: artifact moves from review to publish.
SLA: review within 1 business day; launch-blocking failures within 2 hours.
Steps: inspect source chain, policy verdicts, C2PA manifest, AJE mint state, reviewer identity, and export hash.
Rollback: return artifact to review and invalidate the pending publish token.
Escalation: Isis Provenance owner, editorial lead for the tenant, then release captain.
Audit event: operator.provenance.signoff
Verification: pnpm verify:v3 lilith-provenance-inspector

Owner: Lilith-Commerce
Trigger: user cancellation, provider outage cancellation, chargeback, or tax correction.
SLA: acknowledge within 1 business day; outage refunds within 2 hours.
Steps: verify entitlement, ticket or subscription state, tax jurisdiction, Stripe reversal, royalty waterfall adjustment, and customer notice.
Rollback: reopen billing case and hold royalty payout when reversal fails.
Escalation: Lilith-Commerce lead, finance owner, then Lilith-Rights when royalty settlement is affected.
Audit event: operator.commerce.refund_tax_reversal
Verification: pnpm verify:v3 lilith-refund-tax-reversal

Owner: Lilith-Commerce
Trigger: event capacity opens or verified instructor class capacity changes.
SLA: process within 15 minutes for live events; 1 business day otherwise.
Steps: rank waitlist, check regional eligibility, reserve capacity, send join offer, and expire stale offers.
Rollback: release reserved slot and notify next eligible user.
Escalation: Lilith-Commerce lead, capacity on-call, then event commander.
Audit event: operator.waitlist.promoted
Verification: pnpm verify:v3 lilith-waitlist-promotion-flow

Owner: Incident Commander
Trigger: service degradation, POP outage, provider outage, or recording worker failure.
SLA: first internal update within 5 minutes; public update within 15 minutes for customer-impacting incidents.
Steps: classify severity, select template, publish status update, schedule the next update, and attach postmortem owner.
Rollback: correct status copy through an amended update rather than deleting the incident timeline.
Escalation: incident commander, communications lead, then executive on-call for severity-1 incidents.
Audit event: operator.incident_communications.published
Verification: pnpm verify:v3 grafana-dashboards

Owner: V3 Release Captain
Trigger: GA, hotfix, or regional wave approval.
SLA: decision captured before any production rollout.
Steps: check §70 QA, §71 docs, staffing, region, security, capacity, inventory, and launch-readiness evidence before approving.
Rollback: revoke rollout token and move the release back to blocked.
Escalation: release captain, engineering lead, product lead, then executive approver.
Audit event: operator.release_readiness.decision
Verification: pnpm verify:v3 documentation-runbooks

Owner: Lilith-Privacy
Trigger: DSAR request, consent withdrawal, or recording redaction request.
SLA: acknowledge within 1 business day; statutory deadline tracked per region.
Steps: collect V3 session data, consent ledger entries, recordings, exports, and V1-linked records; approve redaction or export bundle.
Rollback: reopen request with corrected evidence and attach amended export.
Escalation: Lilith-Privacy lead, legal owner, then incident commander if a statutory deadline is at risk.
Audit event: operator.privacy_dsar.reviewed
Verification: pnpm verify:v3 dsar-coverage