Incident runbook for the kill-switch

[JSONbored]

Context

No written process exists for handling an incident once a misbehaving loop has been stopped.

Note: the kill-switch mechanism itself has been split out into #5670 (Kill-switch implementation), which is now open to Gittensor contributors. This issue covers only the written incident runbook — a maintainer/ops responsibility.

Dependencies

Blocked on #4782 (governance spec) and #5670 (kill-switch implementation, so the runbook can be drilled against a real mechanism).

Requirements

1. Write an incident runbook covering detection, activation, and post-incident audit-trail review for a misbehaving loop.
2. Out of scope: the kill-switch mechanism itself — see Kill-switch implementation #5670.

Deliverables / Acceptance Criteria

• A written, tested runbook
• A simulated "misbehaving loop" drill is detected and resolved via the runbook within a defined target time

Test Scenarios

• A live drill: intentionally trigger the kill-switch (via Kill-switch implementation #5670) on a test loop and walk the runbook end-to-end.

Links & Resources

• Third-party autonomy & security governance spec #4782 (governance spec)
• Kill-switch implementation #5670 (kill-switch implementation — the engineering half split from this issue)

---

Part of #4778.

[linear-code]

JSO-3481