Create or update a runbook for an operational scenario — an incident an alert fires for, a recurring scheduled task, or a known failure mode on a live service — using a consistent template.
NewMaintained
Automatic
◆DevOps & SRE pack
Last verified 9/26/2026
What it changes
1 of 23 test cases passed with the skill.
Pass-rate lift
—
Tokens
+11%
Agent turns
0%
Response time
-37%
Model gemini-3.6-flashMeasured 9/26/2026v21 of 23 cases passed with skill · 1 comparable
Tokens, turns and time describe resource use, not a dollar price.
Lift withheld: 1 comparable cases; this report requires 8.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
We need runbooks created for three separate alerts that fired today: `RabbitMQQueueBacklog`, `ElasticsearchClusterYellow`, and `VaultTokenExpired`. Please write all three runbook markdown files in a single batch response.
What was checked, without and with the skill
Checked
Without skill
With skill
The response addresses a single runbook scenario rather than generating a multi-runbook batch.
Missed
Passed
case-12 · gemini-3.6-flash · 9/26/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md225 lines2 files
Create or Update Runbook
Operating Principles
YAGNI applies to runbooks themselves. Apply the evidence-based YAGNI rule from
../../references/yagni-rule.md. A runbook is worth writing only when the scenario is
grounded in something real: an alert that has actually fired, a documented incident, a recurring task that exists, or
a known failure mode on a service that receives production traffic. Runbooks for hypothetical alerts, "best practice
says we should have one," or "we'll need this someday" are YAGNI candidates and the runbook should be deferred until
the scenario actually occurs. The canonical anti-pattern from project history: Sentry runbooks for staging-only Sentry
where data isn't reaching production — alerts that will never fire because no signal flows. The user always wins; the
rule's job is to make the cost of speculative runbooks visible.
The companion evidence rule applies to the runbook's supporting evidence. Apply the evidence rule from
../../references/evidence-rule.md to the citations that ground the scenario: name
the trust class of each piece of evidence (alert history, incident report, on-call rotation pattern); cite the actual
artifact (dashboard URL, ticket ID, log query) rather than paraphrased recollection; and surface single-source claims
as such rather than presenting them as settled.
One runbook per invocation. The skill produces a single runbook file. Multi-runbook batches conflate scope; rerun
the skill per scenario.
Imperative commands with expected output. The template requires every step to show the exact command and what
success looks like. Prose paragraphs in place of commands are an authoring failure the skill prompts against.
Staleness is the failure mode. The template requires owner, last-validated, last-edited, and a change-history
entry so decay is visible rather than hidden. The skill does not enforce a review cadence — that is a team-level
workflow concern — but the metadata fields make the cadence auditable.
Readability standard. Source the standard by invoking han-communication:readability-guidance and apply it as you
write the runbook. Hold its default audience frame: a capable reader who did not do this work and lacks the author's
context — here, the operator following the runbook during an incident.
As your first action, use the Read tool on .han/config.md inside the personal config directory path above. A read
that returns no file is no personal configuration: continue silently. When that file or the project .han/config.md