Bootstrap resilience control plane: intent, risk analysis, first workplan
- INTENT.md: purpose and boundaries of the resilience control plane - specs/ResilienceControlSetup.md: design exploration (tiers, RTO/RPO, 3-2-1) - history/2026-07-04-initial-risk-analysis.md: 12 failure modes ranked, mapped to artifacts - workplans/DISCTL-WP-0002-resilience-foundation.md: registers, policy, first tested restore - DISCTL-WP-0001 T03 (seed first real workplan) done Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
parent
96afc72b8a
commit
2f6f489289
5 changed files with 650 additions and 0 deletions
58
workplans/DISCTL-WP-0001-statehub-bootstrap.md
Normal file
58
workplans/DISCTL-WP-0001-statehub-bootstrap.md
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
---
|
||||
id: DISCTL-WP-0001
|
||||
type: workplan
|
||||
title: "Bootstrap State Hub integration"
|
||||
domain: infotech
|
||||
repo: disaster-control
|
||||
status: ready
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
created: "2026-07-04"
|
||||
updated: "2026-07-04"
|
||||
---
|
||||
|
||||
# Bootstrap State Hub integration
|
||||
|
||||
Resilience control plane for Coulomb Social / Helix Forge: the single source of truth for business continuity, disaster recovery, cyber recovery, and restore-test evidence covering the Coulomb infrastructure (Gitea, k3s, CoulombCore, Bubble.io, Stripe, DNS, secrets).
|
||||
|
||||
## Review Generated Integration Files
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0001-T01
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Review `INTENT.md`, `SCOPE.md`, `AGENTS.md`, and `.custodian-brief.md`.
|
||||
Replace generated placeholders with repo-specific facts where needed.
|
||||
|
||||
## Verify Local Developer Workflow
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0001-T02
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Identify the repo's install, test, lint, build, and run commands. Add or refine
|
||||
those commands in the agent instructions so future coding sessions can verify
|
||||
changes confidently.
|
||||
|
||||
## Seed First Real Workplan
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0001-T03
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Result 2026-07-04: Created `DISCTL-WP-0002-resilience-foundation.md`, derived
|
||||
from the initial risk analysis in `history/2026-07-04-initial-risk-analysis.md`.
|
||||
|
||||
Create the first implementation workplan for the repository's most important
|
||||
next change. After workplan file updates, run the sync locally from this repo
|
||||
checkout:
|
||||
|
||||
```bash
|
||||
statehub fix-consistency
|
||||
```
|
||||
120
workplans/DISCTL-WP-0002-resilience-foundation.md
Normal file
120
workplans/DISCTL-WP-0002-resilience-foundation.md
Normal file
|
|
@ -0,0 +1,120 @@
|
|||
---
|
||||
id: DISCTL-WP-0002
|
||||
type: workplan
|
||||
title: "Resilience foundation: registers, policy, first tested restore"
|
||||
domain: infotech
|
||||
repo: disaster-control
|
||||
status: ready
|
||||
owner: claude-code
|
||||
topic_slug: custodian
|
||||
created: "2026-07-04"
|
||||
updated: "2026-07-04"
|
||||
---
|
||||
|
||||
# Resilience foundation: registers, policy, first tested restore
|
||||
|
||||
Stand up the minimum viable Resilience Control Plane for Coulomb Social /
|
||||
Helix Forge: know what exists (registers), what must survive (policy, RTO/RPO),
|
||||
how it comes back (runbook, panic sheet), and prove it once (drill + evidence).
|
||||
|
||||
Driven by `history/2026-07-04-initial-risk-analysis.md` — priority order R2
|
||||
(untested restores), R9 (silent backup failure), R3 (backup-deleting breach),
|
||||
R4/R5 (identity & secret recovery), R10 (control plane single-homed), R1
|
||||
(full server loss). Design source: `specs/ResilienceControlSetup.md`.
|
||||
|
||||
## Mirror disaster-control off the primary Gitea (R10)
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0002-T01
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
This repo must survive the disasters it describes. Add at least one mirror on
|
||||
infrastructure independent of CoulombCore/Gitea (e.g. GitHub private mirror or
|
||||
secondary machine), document the mirror location in README, and note how the
|
||||
mirror is refreshed.
|
||||
|
||||
## Asset and data registers with Tier-0 recovery paths (R4, R7, R8, R12)
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0002-T02
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Write `AssetRegister.yaml` and `DataRegister.yaml` seeded with the current
|
||||
stack: domains/DNS/registrar, email, Stripe, Bubble.io, OpenRouter, Gitea,
|
||||
CoulombCore content, k3s, databases, backup storage, secrets/OpenBao. Every T0
|
||||
entry must record its recovery path (backup admin, MFA recovery, break-glass).
|
||||
Every T1 entry must name its source of truth and backup mechanism (or mark it
|
||||
`backup: none` honestly). Use the tier model from the spec (§2).
|
||||
|
||||
## ResiliencePolicy and RTO/RPO matrix (R1, R6)
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0002-T03
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Write `ResiliencePolicy.md` (operating principle, tier definitions, drill
|
||||
cadence, evidence requirement) and `RTO-RPO-Matrix.md` with explicit per-system
|
||||
targets, starting from the spec's suggested values (§3): RPO ≤ 24h everywhere,
|
||||
RTO ≤ 1 day full recovery, RTO ≤ 4–8h for code/content/control plane.
|
||||
|
||||
## BackupPolicy with credential separation and monitoring (R3, R9)
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0002-T04
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Write `BackupPolicy.md`: 3-2-1 + immutable/offline model, per-stream mechanisms
|
||||
(gitea dump + mirrors, restic, k3s etcd snapshots, Bubble/Stripe exports,
|
||||
SOPS/age secret vault), and two hard rules with verification steps —
|
||||
(a) backup-storage credentials never live on the production host with delete
|
||||
permission; (b) backup job success and repository integrity are checked on a
|
||||
defined schedule with a named alerting path.
|
||||
|
||||
## Full-server-loss restore runbook and panic sheet (R1, R11)
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0002-T05
|
||||
status: todo
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Write `RestoreRunbooks/01-full-server-loss.md` (new machine → Ansible → secret
|
||||
recovery → data restore → k3s redeploy → validate → DNS cutover → evidence
|
||||
report) and the one-page panic sheet: where backups are, who has access, how to
|
||||
rebuild, how to rotate secrets, how to switch DNS — written so a competent
|
||||
stranger could execute it.
|
||||
|
||||
## First restore drill with evidence file (R2)
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0002-T06
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Perform one real restore to a clean target — smallest meaningful scope (e.g.
|
||||
one Gitea repo from a `gitea dump`, or the secret vault decrypted from cold) —
|
||||
and write `TestEvidence/restore-drill-2026-MM-DD.md` with measured RTO/RPO,
|
||||
result, issues found, and follow-up actions. This task is the exit criterion
|
||||
for the workplan: no drill evidence, not finished.
|
||||
|
||||
## Incident playbooks (R3, R4, R5, R6, R7)
|
||||
|
||||
```task
|
||||
id: DISCTL-WP-0002-T07
|
||||
status: todo
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Write the five playbooks under `IncidentPlaybooks/`: ransomware/hostile access,
|
||||
credential leak, accidental delete / data corruption, provider outage
|
||||
(Bubble/Stripe/OpenRouter/DNS/email), loss of admin identity. Keep each to one
|
||||
page of numbered steps per the spec (§6).
|
||||
Loading…
Add table
Add a link
Reference in a new issue