On-call rotation

On-call rotates weekly. Handoff is Monday 09:00 Europe/Berlin — the outgoing on-call posts a 3-line summary in #oncall-handoff (open incidents, in-flight changes touching the rotation’s surface, anything weird in Sentry that didn’t page).

Today the rotation is solo for every column (founder build phase). The structure below is the scale-out target — additions land via PR against this page.

Rotations

Rotation	Surface	Current	Backup
Auction	`apps/api/auction-*`, `packages/auction-engine`, `AuctionDO`, `apps/cron`	@arnekellmann	—
Payment	`apps/api/payment-`, `apps/api/saga-`, `packages/saga`, `apps/webhook`	@arnekellmann	—
Identity	`apps/api/auth-*`, `packages/users`, `packages/auth`, Stripe Identity	@arnekellmann	—
Infra	`infra/terraform`, `.github/workflows`, Cloudflare account, DNS	@arnekellmann	—
Generalist	Everything else, default fallback	@arnekellmann	—

Scale-out target: once a second human joins the rotation, a single person is on at most two rotations simultaneously and never on all five. Until then the solo-phase exception above applies — @arnekellmann carries every page and there is no escalation path. Cross-rotation context-switching cost is the dominant operational risk during this phase; defer non-urgent rotation work when a page is active.

What on-call owns

Acknowledge pages within 10 minutes (business hours) or 30 minutes (off-hours).
Drive incidents per incident response until handed off or resolved.
Triage Sentry alerts that didn’t page but accumulated overnight.
Approve emergency deploys outside the normal review path — only with another reviewer’s lazy-consensus ack in #incidents.

What on-call does NOT own

Routine PR review (other than emergency deploys).
Long-running migrations or infra changes — those need a planned window.
Customer support tickets — separate rotation when one exists.

Tools

Pager: PagerDuty (TBD — currently Slack @oncall mention)
Dashboards: Cloudflare, Stripe, Sentry
Tail: npx wrangler tail --env production — see PII caveat in incident response