Incident Response Runbook

flowchart TD
  A[Alert fires] --> B{Severity?}
  B -->|SEV-1| C[Page on-call]
  B -->|SEV-2 / 3| D[Create ticket]
  C --> E[Open incident channel]
  E --> F[Mitigate]
  F --> G{Resolved?}
  G -->|No| F
  G -->|Yes| H[Write postmortem]
  D --> H
  H --> I[Track action items]