Incident Response Runbook

First response

Start by pausing the affected workflow, watcher, agent, custom tool, or publishing path. Preserve the exact timestamp, user, screen, prompt, approval state, and affected records before changing settings. If customer-facing behavior is affected, assign an owner for communication and remediation immediately.

Evidence collection

Use audit log review to reconstruct the decision chain and diagnostics and support to capture environment state. Do not send raw logs, credentials, provider keys, payment data, or full customer records to support without redaction.

Recovery path

Decide whether the incident needs rollback, manual correction, provider escalation, hosting support, or a SophMate support request. The update and rollback docs cover release-related recovery, and contact is available for support routing.

Quick reference

• Use this page when collecting diagnostics, reproducing errors, planning updates, routing support, or documenting incident recovery.
• Do not share raw logs, provider keys, server credentials, purchase codes, payment data, or unrelated customer records as support evidence.
• Key decision: whether the evidence is fresh, redacted, reproducible, routed to the right owner, and safe to share.

Scope limits

• Do not use this page to share raw logs, credentials, purchase codes, or unredacted customer records while trying to accelerate support.
• This page does not replace hosting, provider, CodeCanyon, or internal incident ownership.
• Use it to collect safe evidence and route the issue without exposing secrets or unrelated private records.

Owner and cadence

• Primary owner: support lead or site administrator responsible for triage and evidence handling.
• Review cadence: when an issue is reported, before support contact, and after recovery to improve the runbook.
• Escalate when evidence is incomplete, private data may be exposed, production impact continues, or routing between host, provider, and plugin support is unclear.

Access and data boundary

• Support evidence should preserve exact error codes, timestamps, URLs, user agents, diagnostics, and reproduction paths while removing secrets and unrelated private data.
• Use support-safe diagnostics, exact timestamps, reproduction steps, version details, and affected-screen context instead of raw logs or broad database exports.
• Share provider keys, server credentials, purchase codes, payment data, customer records, and private logs only through approved secure channels when explicitly required.

Production checklist

• Pause the affected module, preserve timestamps and affected records, assign an incident owner, and stop repeated execution.
• Collect audit records, diagnostics, screenshots, provider status, hosting status, and reproduction steps before changing multiple settings.
• Capture exact timestamp, affected user, affected screen, SophMate version, WordPress version, PHP version, and reproduction steps.
• Redact provider keys, credentials, payment data, private customer details, and raw logs before support handoff.

Acceptance checks

• The team can explain impact, root-cause hypothesis, owner, remediation, and prevention step.
• Support escalation includes redacted evidence and avoids secrets or unrelated customer records.
• The support report lets another operator reproduce or triage the issue without receiving secrets.
• The team knows whether to escalate to hosting, provider support, CodeCanyon support, or internal operations.

Failure modes to test

• Test repeated errors, stale diagnostics, failed migration or reindexing, missing purchase context, untested rollback, wrong support route, and incomplete incident prevention notes.
• Test stale diagnostics, repeated error codes, missing reproduction steps, unredacted evidence, wrong escalation route, failed update, and incomplete rollback proof.
• Confirm support handoff preserves timestamps and codes while removing secrets and unrelated private data.

Evidence to capture

• Capture incident owner, impact, timeline, affected records, diagnostics, redaction review, support route, and prevention follow-up.
• Record exact timestamp, screen, URL, user role, SophMate version, environment details, error code, reproduction path, and diagnostics status.
• Capture what was redacted from logs, screenshots, support bundles, and customer-related evidence.

Decision record

• Decision field to include: exact error or release context, redaction status, rollback proof, support route, prevention owner, and restart criteria.
• Record the support decision, severity, affected screen, timestamp, environment details, reproduction path, owner, routing path, and redaction status.
• Include whether the issue belongs to hosting, provider support, CodeCanyon/plugin support, internal operations, or a post-incident prevention task.

Stop or rollback path

Stop retries, updates, or support handoffs when evidence is incomplete, secrets are exposed, ownership is unclear, or rollback is untested. Resume after diagnostics, redaction, support route, and prevention notes are complete.

Monitoring window

• Track recurrence, prevention tasks, owner follow-through, support status, and whether restart criteria remain valid.
• Monitor repeat errors, unresolved diagnostics, support response state, redaction quality, and owner handoff until closure.
• Review prevention notes after the issue is resolved so the next request is easier to triage.

Expansion criteria

• Operational runbooks can expand only after rollback, diagnostics, redaction, prevention owners, and restart criteria are validated.
• Standardize the support path only after reproduction, diagnostics, redaction, routing, and prevention notes are complete.
• The next operator can use the same report format without exposing secrets or unrelated customer data.

Common mistakes

• Retrying or changing settings repeatedly before preserving the exact error report, timestamp, and affected screen.
• Opening support requests with raw logs or vague descriptions instead of redacted diagnostics and reproduction steps.

Common questions

What makes support evidence useful?

Useful evidence is fresh, reproducible, timestamped, redacted, tied to a specific screen or failure, and routed to the right owner or support channel.

Who should own this decision?

The support lead or site administrator should own the report until it is routed to hosting, provider, CodeCanyon support, or internal operations.

What should stop the rollout?

Stop when evidence is stale, reproduction is missing, redaction is uncertain, or the support route is wrong.

Related operations

• Use Contacting Support before opening a support request.
• Use Support SLA and Escalation Matrix before customer-visible support routing.
• Use Error Reports and Support Codes before redacting or sharing an error report.
• Use Migration and Reindex Review before restarting workflows after updates.
• Use Post-Incident Review and Prevention before returning paused work to normal scope.
• Use Changelog and Release Note Review before release decisions.