Ops & runbooks

The supervisor watches the running economy through its own telemetry ports and remediates under guardrails; these pages are the operational surface around it, plus one runbook per incident signature.

• The supervisor

  The in-process ops supervisor at the ./ops entry point: signal capture over the meter/logger ports, twelve incident signatures, guarded remediations, and an audit trail.

• The audit trail

  Every supervisor decision as append-only JSONL, and the hash-chained sink that makes the trail itself tamper-evident — verified by make audit-verify.

• Backup & restore

  make backup dumps each engine data-only; make restore-drill restores the newest dump into a scratch namespace and runs the full prover against it.

• Key rotation

  Rotating the checkpoint signer: the new secret in SIGNING_SECRET, the old in SIGNING_SECRETS_PRIOR, so every checkpoint ever sealed keeps verifying.