Sysadmin runbooks in a tree: AI optional, secrets never

Incident night loves chat apps and hates unfinished Wikis. You paste a log fragment into a model, get a plausible next command, and — if you are careless — a password or API token rides along in the same clipboard. Six months later nobody knows which runbook is current because “the good version” lived in a Slack thread that scrolled away.

SEO Note is a free Windows tree outliner (~2.45 MB, one local file, no account, no cloud sync, no built-in AI). Structure ops knowledge as contour → runbook → postmortem. Models may help rephrase steps or turn a messy timeline into a draft postmortem — only on sanitized text you curated. This is the ops flavor of local notes as source of truth.

Ops knowledge vs disposable help

In SEO Note

• Service contours
• Runbook steps
• Contacts / escalation
• Postmortems + actions

In the AI chat

• Sanitize-then-ask
• Draft timelines
• Wording cleanup
• One-off command ideas

If the model never sees production credentials, you already won half the battle. The other half is writing the accepted steps back into the runbook node.

Tree skeleton for contours

Ops
  Contour — payments-api
    Inventory (hosts roles, no secrets)
    Runbooks
      Deploy
      Rollback
      Cert renew
      On-call first 15 min
    Escalation
    Postmortems
      2026-03-04 — latency spike
        Timeline
        Impact
        Actions (owners / due)
    AI scratch (redacted only)
  Contour — edge CDN
    Runbooks
    Postmortems

Inventory lists roles and hostnames you are allowed to document — not passwords. Put secrets in the vault your org already mandates; in the tree write “see vault: path/name” and stop.

Symptoms the runbook is not the authority

• Two people paste different Rollback sequences into the incident channel
• You find a token in an old AI chat while searching for a hostname
• Postmortem Actions have no owners, so the same outage shape returns
• On-call first 15 min lives only in someone’s head who is on holiday

What to paste into AI

Redact first. Replace tokens with <REDACTED>, strip customer PII, drop internal URLs you would not put in a public ticket. Paste one runbook section or a timeline stub — not the whole Ops parent.

Prompt:
You are helping edit an ops note. Do not invent credentials,
IPs, or ticket IDs. Point out missing steps as questions.
Rewrite the timeline below into clear bullets; flag ambiguity.
---
[paste redacted timeline or runbook section]

NEVER paste passwords, API keys, private keys, session cookies, connection strings with credentials, MFA backup codes, or full .env / vault exports into AI. If it unlocks something, it does not belong in a chat — period.

How-to in one sitting

1. Create Ops → one Contour you own on-call for → Inventory / Runbooks / Escalation / Postmortems / AI scratch.
2. Write On-call first 15 min as a checklist you could follow half-asleep (links to dashboards OK; no secrets).
3. Add Deploy and Rollback as sibling runbooks; keep steps numbered and dull on purpose.
4. For the last incident (even a small one), create a Postmortem child with Timeline / Impact / Actions.
5. If you want AI help on the timeline, redact a copy into AI scratch, paste that copy only, then merge accepted wording by hand.
6. Assign Actions with owners and due dates in the note — not only in the chat.
7. Copy the notes file to the backup location your team already trusts (USB, second disk, encrypted share policy).

Incident → note → optional AI

1 Stabilize with the runbook

2 Log timeline locally

3 Redact a copy if needed

4 Optional AI cleanup

5 Commit Actions in the tree

	Chat as runbook	Tree as runbook
Authority at 03:00	Whoever typed last	Named Contour node
Secret hygiene	Clipboard roulette	Pointers to vault only
Postmortem reuse	Lost in scroll	Dated child + Actions
Offline lab / outage	Model unreachable	File still opens

Pitfalls and honest limits

• “Just this once” pasting a token to “debug faster” — treat it as a credential leak and rotate
• Letting AI invent firewall rules or kubectl commands you do not understand — verify against docs and staging
• Three Rollback docs in three tools with no “source of truth” label — pick the tree or the official Wiki and link the other
• SEO Note is not PagerDuty, not a secrets manager, not multiplayer Confluence; it is a private or team-local outline on Windows
• No mobile parity, no sync, no built-in AI — pair with your existing on-call stack
• Org policy may forbid any third-party AI on ops text; then skip the chat entirely and keep the tree

Privacy habits for any role — not only ops — live in related guides like what not to paste into AI when that page is on your reading list; the same spine shows up for freelancers in freelancer notes tree. PARA-style Areas (ongoing contours) vs Projects (this migration): PARA in a notes tree. Skeletons: templates.

Next steps

1. Create one Contour with On-call first 15 min and Rollback
2. Move secrets references to “vault path only”
3. File one recent incident as a Postmortem with Actions
4. Practice one redacted AI cleanup — or skip AI if policy says so
5. Verify a backup copy of the notes file exists off the main disk

Download SEO Note free and keep runbooks where you control the file — models never need your keys.

Keep going

• Tree templates and PDF guide — role/method skeletons (card checkout via YooKassa when enabled).
• If this guide helped, you can say hello or grab ready-made trees on the templates page.

Adjacent tools (VPS for local models, courses, VPN) are not stuffed into every paragraph. If an affiliate link appears, it will be labeled and is never required to use SEO Note.

Related: Source of truth for AI · Freelancer notes tree · PARA method tree · Backup notes to USB · Templates · FAQ