# TreLLM Operator Runbook Checklist

This offline artifact shows the human-gated controls a live-capable path must name before it can be reviewed.
It is not a broker adapter and it does not authorize live submission.

## Boundary

- Default mode: `offline_export`
- Live submission in this demo: `false`
- Manual approval required: `true`
- Kill switch required: `true`
- Approval expiry required: `true`
- Artifact retention required: `true`

## Checklist

| ID | Owner | Evidence | Pass condition |
| --- | --- | --- | --- |
| `mode-boundary` | operator | adapter mode recorded as offline_export, dry_run, paper_sandbox, or live_human_approved | default path cannot submit live orders |
| `approval-expiry` | operator | broker approval artifact with approved_at, expires_at, max_notional, max_quantity, and request hash | approval is unexpired and bound to the reviewed handoff artifact |
| `kill-switch` | operator | kill switch flag or disable control checked before handoff | tripped kill switch blocks every broker-facing path |
| `reconciliation` | reviewer | broker response artifact with status counts, missing responses, unmatched responses, and redacted reasons | reconciliation summary validates against response rows |
| `rollback` | operator | rollback owner, account mode, affected symbols, and disable-submission decision are named | operator can disable submission before any retry |
| `artifact-retention` | reviewer | reviewed handoff, approval artifact, response artifact, command transcript, and retention path are named | audit bundle can be preserved without raw credentials or private holdings |
| `incident-owner` | incident-owner | one redacted incident owner is named for escalation, rollback approval, and final signoff | ownership is explicit before the path is considered live-capable |

## Incident Response

1. Trip the kill switch or disable flag before creating any broker-facing artifact.
2. Preserve the reviewed handoff, approval artifact, response artifact, and command transcript.
3. Reconcile broker-visible statuses against TreLLM client order IDs.
4. Record the incident owner, affected account mode, affected symbols, and rollback decision.
5. Re-enable only after a new approval artifact and reviewed request hash are created.

## Incident Drill

| Field | Value |
| --- | --- |
| Kill switch action | `disable_broker_submission` |
| Rollback owner | `operator` |
| Affected account mode | `paper` |
| Affected symbols | `AAPL, MSFT` |
| Artifact retention path | `outputs/examples/operator_runbook/incident_drill/` |
| Re-enable approval gate | new approval artifact bound to a newly reviewed handoff hash |