# WYG Monitoring and Alerting Runbook — Pilot

**Status:** Application hooks implemented; alert destinations require activation
**Updated:** August 23, 2026

## Signals

- `/api/health`: public, minimal application and D1 probe; HTTP 200 when healthy and 503 when unavailable.
- `/api/ops/readiness`: secret-protected operational check for required tables, private-file binding, audit trail, logging, rate limiting, and backup-control declaration.
- Cloudflare Workers Logs: invocation logs, custom structured errors, uncaught exceptions, and request IDs.
- Operational events: hashed abuse signals, denied operations access, readiness checks, and control failures.
- Program audit trail: coach-visible important administrative and testing events.

No monitoring response may expose a team name, student, playbook, answer key, credential, token, raw IP address, or uploaded filename. Request IDs connect a school report to restricted logs.

## Required alerts

| Alert | Trigger | Initial severity | Owner action |
|---|---|---|---|
| Uptime failure | Two consecutive non-200 health probes | High | Verify platform status and database connectivity; open incident if user impact continues |
| 5xx spike | Five server errors in five minutes or a material increase over baseline | High | Group by request ID/path, contain bad release or failing dependency |
| Uncaught exception | Any repeated exception signature | High | Reproduce safely, determine student impact, patch or roll back |
| Rate-limit spike | Repeated 429 events from the same hashed subject or scope | Medium | Check credential stuffing, automation, or a legitimate team traffic burst |
| Operations denial | Any repeated failed secret-protected access | High | Validate maintainer activity; rotate secret and investigate if unexpected |
| Backup check failure | Scheduled restore-point verification fails | High | Confirm D1 account/backend; pause risky changes until recovery is verified |
| Dependency vulnerability | High or critical production advisory | High | Assess exploitability, update/test/release, and document disposition |

## Activation test

Before the pilot, an independent monitor must poll the health endpoint every five minutes from outside the hosting account. Test both recovery and alerting by temporarily pointing the monitor at an agreed failing path or using its test-alert function; do not intentionally disable the production database. Confirm primary and backup recipients receive, acknowledge, and close the alert.

Cloudflare log access is limited to approved maintainers. Retention and export must be configured before student use. Review logs without copying student data into tickets. If a log contains unexpected sensitive data, restrict access, preserve only required evidence, remediate the logging source, and follow incident triage.