Forensics and Runbook Handoffs

This guide is the canonical v1.4 source for how operators move from diagnosis to follow-up while keeping ownership and support-truth boundaries explicit.

Operator Journey Spine

DOC05-C1: The canonical operator journey is /ops/jobs -> /ops/jobs/forensics -> ownership-labeled next path -> /ops/jobs/audit.

Use that path when moving from native diagnosis to follow-up and then back to auditable evidence.

Evidence Boundaries

DOC05-C2: Forensics evidence can be complete or incomplete, and operators must treat these labels as authoritative:

• partial evidence
• history unavailable
• unknown

If a label shows incomplete evidence, prefer explicit follow-up instead of assuming hidden certainty.

Ownership-Labeled Next Paths

At each decision point, keep the next path label explicit:

• Powertools-native - native page flow for Audited action.
• Oban Web bridge - Inspection only.
• host-owned follow-up - downstream investigation or escalation outside Powertools ownership.

Escalation Status Truth

DOC05-C3: Powertools can only claim host follow-up status visibility for unconfigured, invoked, and failed.

These statuses describe what Powertools can observe, not downstream provider outcomes.

What Powertools Does Not Claim

Powertools does not claim provider delivery certainty, and it does not claim external runbook truth. Paging delivery, ticket completion, and downstream human/process outcomes remain host-owned responsibilities.