# Chris Roos: a method for SRE and automation work > Strategy documents for SRE work, the math behind the decisions, and operating rules for AI agents, in plain markdown. Generic, with no company data. Fetch this file, then only the pages that match your task. ## Start here - [AGENTS.md](https://christwentyfour.com/AGENTS.md): Starter instructions to paste into your own agent: operating rules, the core loop, how to use this site. - [Start here](https://christwentyfour.com/sre/start-here.md): The map of these strategy documents for AI agents and humans, what each page covers, and the order to read it in. - [The whole site in one file](https://christwentyfour.com/llms-full.txt): Every page below as markdown, concatenated. Large. Prefer the single pages. ## How I work - [Engineering strategy](https://christwentyfour.com/strategy.md): The decision model as equations: maximize changes shipped, subject to the SLO; priority is changes over cost. - [Working with Claude](https://christwentyfour.com/working-with-claude.md): Briefs, guardrails, and scheduled agents for infrastructure work. ## Foundations - [Agent operating rules for SRE](https://christwentyfour.com/sre/agent-operating-rules.md): The default rules an AI agent follows before it touches any production system, so it is useful without being dangerous. - [SLOs and error budgets](https://christwentyfour.com/sre/slos-and-error-budgets.md): How to pick SLIs, set an SLO, alert on burn rate and use the error budget to decide between shipping features and fixing reliability. - [Postmortems](https://christwentyfour.com/sre/postmortems.md): A blameless postmortem template and a fully worked fictional example, so an agent can draft one from an incident timeline in minutes. ## Operations - [Incident triage](https://christwentyfour.com/sre/incident-triage.md): How an agent takes the first fifteen minutes of an incident, from alert to a clear status, a likely cause and a human-approved mitigation. - [Alert and monitor hygiene](https://christwentyfour.com/sre/alert-and-monitor-hygiene.md): How to audit monitors so every alert is actionable, owned and routed, and nothing important is silently muted or stuck in No Data. - [AWS read-only investigation](https://christwentyfour.com/sre/aws-read-only-investigation.md): How an agent explores AWS accounts safely with read-only roles, explicit profiles and copy-paste recipes for the questions SREs ask most. - [Ticket triage and closeout](https://christwentyfour.com/sre/ticket-triage-and-closeout.md): How to work an SRE queue end to end, from classifying new tickets to closing stale review and blocked piles with evidence. - [Backups and restore testing](https://christwentyfour.com/sre/backups-and-restore-testing.md): How to check that every data store is backed up to policy, and how to prove it by restoring on a schedule. - [Monitors and dashboards as code](https://christwentyfour.com/sre/monitors-and-dashboards.md): How to export, audit and manage monitors, downtimes and dashboards as code, with read-only recipes an agent can run. - [Scheduled jobs and file transfers](https://christwentyfour.com/sre/scheduled-jobs-and-file-transfers.md): How to triage a failed scheduled job or file transfer, recover the missed run safely and stop it failing silently next time. - [On-call handoff](https://christwentyfour.com/sre/on-call-handoff.md): A short, structured handoff at every rotation change so the next on-call knows what is burning, what is fragile and what is scheduled. ## Delivery - [Blue-green deploys with one-click rollback](https://christwentyfour.com/sre/blue-green-deploys-with-rollback.md): Deploy a candidate next to the live version, smoke-test it, promote on success, and keep the previous version one button away; a worked example on a container service and your CI provider. - [CI/CD pipeline migration](https://christwentyfour.com/sre/ci-cd-pipeline-migration.md): How to move a repository's pipeline from one CI system to another, one repo at a time, with parity checks and no big-bang cutover. - [Short-lived cloud credentials for CI](https://christwentyfour.com/sre/oidc-from-ci-to-cloud.md): Replace stored cloud access keys in CI with short-lived credentials from your CI provider's OIDC issuer, scoped per project, branch and environment. - [Repo governance and branch protection](https://christwentyfour.com/sre/repo-governance-and-branch-protection.md): The minimum controls every repository needs (protected default branch, required review, CODEOWNERS, no force-push, clean group structure) and how to audit them. - [Terraform changes via merge request](https://christwentyfour.com/sre/terraform-changes-via-merge-request.md): How to change infrastructure safely with Terraform or OpenTofu, with plan in the MR, apply after approval, and routines for drift, state and imports. - [Onboarding a new service](https://christwentyfour.com/sre/onboarding-a-new-service.md): The production-readiness checklist a new service passes before it takes real traffic, from repo and pipeline to monitoring, backups and on-call. ## Security & Access - [Access requests and least privilege](https://christwentyfour.com/sre/access-requests-and-least-privilege.md): How to turn "please give me access" into a time-bound, least-privilege grant through code, with an approver, an expiry and evidence for audit. - [Certificate renewal and expiry tracking](https://christwentyfour.com/sre/certificate-renewal-and-expiry.md): How to find every certificate before it expires, renew the managed ones automatically and run a safe, rehearsed renewal for the ones that are not. - [Secret rotation and exposed secrets](https://christwentyfour.com/sre/secret-rotation-and-exposed-secrets.md): What to do in the first hour after a secret is exposed, and how to rotate keys, tokens and passwords routinely without an outage. - [AWS account and resource decommissioning](https://christwentyfour.com/sre/aws-account-and-resource-decommissioning.md): How to prove something is unused, retire it in reversible stages and close an AWS account without breaking a hidden dependency. - [Vulnerability and patch response](https://christwentyfour.com/sre/vulnerability-and-patch-response.md): How to go from a CVE or scanner finding to a patched, verified fleet, with severity-based deadlines and a fast path for actively exploited bugs. - [Change control in regulated environments](https://christwentyfour.com/sre/change-control-in-regulated-environments.md): How to plan, approve, ship and evidence a production change inside a compliance scope, including release tickets, change windows and emergency changes. - [Security baseline remediation](https://christwentyfour.com/sre/security-baseline-remediation.md): How to run a cloud security sweep (flow logs, HTTPS-only load balancers, public databases, dead event targets, plaintext build secrets, broad IAM) and fix findings in safe batches. ## Cost - [Cost cleanup](https://christwentyfour.com/sre/cost-cleanup.md): A repeatable monthly sweep that finds idle and oversized cloud spend, proves it is safe to cut, and books the savings. ## Automation - [Setting up herdr for agent jobs](https://christwentyfour.com/sre/herdr-setup-for-agents.md): Install herdr, organise workspaces, tabs and panes for agents, and run headless Claude jobs at low priority with logs you can read later. - [Connecting Jira for agents](https://christwentyfour.com/sre/connecting-jira.md): Connect an agent to Jira through the Atlassian MCP server or a CLI with an API token kept in a secret store, then read with JQL and write comments and transitions only behind approval. - [Claude Code for SRE work](https://christwentyfour.com/sre/claude-code-for-sre.md): Set up Claude Code so it is useful on infrastructure repos and safe around production, with a CLAUDE.md, tight permissions, a secret filter, headless mode and changes only through merge requests. - [Automation blueprint for SRE toil](https://christwentyfour.com/sre/automation-blueprint.md): A step-by-step design for automating routine SRE toil with scripts, headless agents and one daily approval queue, while humans keep every decision that matters. - [Human-in-the-loop approval patterns](https://christwentyfour.com/sre/human-in-the-loop-approvals.md): Patterns that let agents do the work while a human keeps control: dry-run by default, draft-then-post, approval queues, two-key changes and kill switches. ## Posts - [How SREs Deal With Tech Debt](https://christwentyfour.com/blog/0001_SRE_fight_tech_debt.md): Automation, monitoring, and guardrails keep tech debt from becoming outages. - [Alerts That Earn the Page](https://christwentyfour.com/blog/alerts-that-earn-the-page.md): If nothing can be done at 3am, it is not a page. How to build a pager people trust. - [The First Hour of an Incident](https://christwentyfour.com/blog/the-first-hour-of-an-incident.md): Three roles and one shared document. Mitigate first, understand second. - [Postmortems That Change Something](https://christwentyfour.com/blog/postmortems-that-change-something.md): Most reviews produce a document and no change. Why, and what to do instead. - [Your First SLO](https://christwentyfour.com/blog/your-first-slo.md): One service, one number, and a target you already meet. - [Dashboards Nobody Opens](https://christwentyfour.com/blog/dashboards-nobody-opens.md): Ninety dashboards, four in use. Build for a question, not a system. - [Logs Are Not Free](https://christwentyfour.com/blog/logs-are-not-free.md): A log line is free to write and expensive at 3am. Levels, structure, cardinality, retention. - [The Runbook Test](https://christwentyfour.com/blog/the-runbook-test.md): A runbook is real if someone else can run it on the worst night of the quarter. - [Staging Lies to You](https://christwentyfour.com/blog/staging-lies-to-you.md): Staging answers a weaker question than the one you ask. What it is good for. - [The Restore You Have Never Run](https://christwentyfour.com/blog/the-restore-you-have-never-run.md): A backup you have never restored is untested. Restore one on a schedule and time it. - [What Production-Ready Actually Means](https://christwentyfour.com/blog/what-production-ready-actually-means.md): Six questions specific enough that two people would reach the same verdict. - [On-Call Is a Design Constraint](https://christwentyfour.com/blog/on-call-as-a-design-constraint.md): The pager is a feedback loop, and where you point it decides what gets built. - [The Five-Minute Manual Step](https://christwentyfour.com/blog/the-five-minute-manual-step.md): Too small for a ticket, too frequent to ignore. The math is worse than it looks. - [Automate the Thing You Hate](https://christwentyfour.com/blog/automate-the-thing-you-hate.md): Pick the task you dread over the most frequent one. Dread is a decent proxy for risk. - [Feature Flags Are an Operational Tool](https://christwentyfour.com/blog/feature-flags-are-an-operational-tool.md): Separating deploy from release makes frequent deploys safe. Kill switches, load shedding, and flag debt. - [The Migration That Never Finishes](https://christwentyfour.com/blog/the-migration-that-never-finishes.md): The most expensive state a system can be in is halfway between two designs. Plan the last service first. - [Dependency Upgrades Are Reliability Work](https://christwentyfour.com/blog/dependency-upgrades-are-reliability-work.md): The least popular reliability work. Skipping it costs more than linearly. - [Capacity Planning Without a Crystal Ball](https://christwentyfour.com/blog/capacity-planning-without-a-crystal-ball.md): Skip the forecast. You need headroom, growth rate, and how long it takes to add capacity. - [What Change Failure Rate Hides](https://christwentyfour.com/blog/what-change-failure-rate-hides.md): The delivery metric that is easiest to game without meaning to. - [Cost Is a Reliability Signal](https://christwentyfour.com/blog/cost-is-a-reliability-signal.md): A spend spike is often the first sign that something is technically wrong. - [Secrets, the Boring Way](https://christwentyfour.com/blog/secrets-the-boring-way.md): Most secret failures are a credential in a place nobody counted as a place. - [One Paycheck Rarely Covers the Basics, Let Alone a Full Tithe](https://christwentyfour.com/blog/economics-of-lds-membership.md): A one-earner family of five at the median young-family income is about $15,500 short of basics plus a full tithe. Only about 31% of Madison County households earn the $95,560 a full tithe takes. Estimates, November 2026. ## Runbooks - [Terraform](https://christwentyfour.com/runbooks/terraform.md): Remote state from day one. Modules as components. A plan a human reads. - [Containers & ECS](https://christwentyfour.com/runbooks/containers.md): Config comes in at startup, with no SDK calls at boot. It runs on a laptop with no cloud credentials. - [CI/CD Pipelines](https://christwentyfour.com/runbooks/pipelines.md): The pipeline decides whether a change is safe. Keep logic in scripts, and keep it under fifteen minutes. - [Observability](https://christwentyfour.com/runbooks/observability.md): Logs, metrics, and traces answer different questions. Structured logs are the prerequisite for letting an agent near an incident. - [Python Automation](https://christwentyfour.com/runbooks/python.md): Most ops work is glue. Make it idempotent, observable, and safe to run twice. ## Optional - [About](https://christwentyfour.com/about.md): Short bio, and that I am open to Senior SRE roles.