Bootstrap resilience control plane: intent, risk analysis, first workplan

- INTENT.md: purpose and boundaries of the resilience control plane
- specs/ResilienceControlSetup.md: design exploration (tiers, RTO/RPO, 3-2-1)
- history/2026-07-04-initial-risk-analysis.md: 12 failure modes ranked, mapped to artifacts
- workplans/DISCTL-WP-0002-resilience-foundation.md: registers, policy, first tested restore
- DISCTL-WP-0001 T03 (seed first real workplan) done

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-04 12:45:16 +02:00
parent 96afc72b8a
commit 2f6f489289
5 changed files with 650 additions and 0 deletions

View file

@ -0,0 +1,58 @@
---
id: DISCTL-WP-0001
type: workplan
title: "Bootstrap State Hub integration"
domain: infotech
repo: disaster-control
status: ready
owner: codex
topic_slug: custodian
created: "2026-07-04"
updated: "2026-07-04"
---
# Bootstrap State Hub integration
Resilience control plane for Coulomb Social / Helix Forge: the single source of truth for business continuity, disaster recovery, cyber recovery, and restore-test evidence covering the Coulomb infrastructure (Gitea, k3s, CoulombCore, Bubble.io, Stripe, DNS, secrets).
## Review Generated Integration Files
```task
id: DISCTL-WP-0001-T01
status: todo
priority: high
```
Review `INTENT.md`, `SCOPE.md`, `AGENTS.md`, and `.custodian-brief.md`.
Replace generated placeholders with repo-specific facts where needed.
## Verify Local Developer Workflow
```task
id: DISCTL-WP-0001-T02
status: todo
priority: high
```
Identify the repo's install, test, lint, build, and run commands. Add or refine
those commands in the agent instructions so future coding sessions can verify
changes confidently.
## Seed First Real Workplan
```task
id: DISCTL-WP-0001-T03
status: done
priority: medium
```
Result 2026-07-04: Created `DISCTL-WP-0002-resilience-foundation.md`, derived
from the initial risk analysis in `history/2026-07-04-initial-risk-analysis.md`.
Create the first implementation workplan for the repository's most important
next change. After workplan file updates, run the sync locally from this repo
checkout:
```bash
statehub fix-consistency
```

View file

@ -0,0 +1,120 @@
---
id: DISCTL-WP-0002
type: workplan
title: "Resilience foundation: registers, policy, first tested restore"
domain: infotech
repo: disaster-control
status: ready
owner: claude-code
topic_slug: custodian
created: "2026-07-04"
updated: "2026-07-04"
---
# Resilience foundation: registers, policy, first tested restore
Stand up the minimum viable Resilience Control Plane for Coulomb Social /
Helix Forge: know what exists (registers), what must survive (policy, RTO/RPO),
how it comes back (runbook, panic sheet), and prove it once (drill + evidence).
Driven by `history/2026-07-04-initial-risk-analysis.md` — priority order R2
(untested restores), R9 (silent backup failure), R3 (backup-deleting breach),
R4/R5 (identity & secret recovery), R10 (control plane single-homed), R1
(full server loss). Design source: `specs/ResilienceControlSetup.md`.
## Mirror disaster-control off the primary Gitea (R10)
```task
id: DISCTL-WP-0002-T01
status: todo
priority: high
```
This repo must survive the disasters it describes. Add at least one mirror on
infrastructure independent of CoulombCore/Gitea (e.g. GitHub private mirror or
secondary machine), document the mirror location in README, and note how the
mirror is refreshed.
## Asset and data registers with Tier-0 recovery paths (R4, R7, R8, R12)
```task
id: DISCTL-WP-0002-T02
status: todo
priority: high
```
Write `AssetRegister.yaml` and `DataRegister.yaml` seeded with the current
stack: domains/DNS/registrar, email, Stripe, Bubble.io, OpenRouter, Gitea,
CoulombCore content, k3s, databases, backup storage, secrets/OpenBao. Every T0
entry must record its recovery path (backup admin, MFA recovery, break-glass).
Every T1 entry must name its source of truth and backup mechanism (or mark it
`backup: none` honestly). Use the tier model from the spec (§2).
## ResiliencePolicy and RTO/RPO matrix (R1, R6)
```task
id: DISCTL-WP-0002-T03
status: todo
priority: high
```
Write `ResiliencePolicy.md` (operating principle, tier definitions, drill
cadence, evidence requirement) and `RTO-RPO-Matrix.md` with explicit per-system
targets, starting from the spec's suggested values (§3): RPO ≤ 24h everywhere,
RTO ≤ 1 day full recovery, RTO ≤ 48h for code/content/control plane.
## BackupPolicy with credential separation and monitoring (R3, R9)
```task
id: DISCTL-WP-0002-T04
status: todo
priority: high
```
Write `BackupPolicy.md`: 3-2-1 + immutable/offline model, per-stream mechanisms
(gitea dump + mirrors, restic, k3s etcd snapshots, Bubble/Stripe exports,
SOPS/age secret vault), and two hard rules with verification steps —
(a) backup-storage credentials never live on the production host with delete
permission; (b) backup job success and repository integrity are checked on a
defined schedule with a named alerting path.
## Full-server-loss restore runbook and panic sheet (R1, R11)
```task
id: DISCTL-WP-0002-T05
status: todo
priority: medium
```
Write `RestoreRunbooks/01-full-server-loss.md` (new machine → Ansible → secret
recovery → data restore → k3s redeploy → validate → DNS cutover → evidence
report) and the one-page panic sheet: where backups are, who has access, how to
rebuild, how to rotate secrets, how to switch DNS — written so a competent
stranger could execute it.
## First restore drill with evidence file (R2)
```task
id: DISCTL-WP-0002-T06
status: todo
priority: high
```
Perform one real restore to a clean target — smallest meaningful scope (e.g.
one Gitea repo from a `gitea dump`, or the secret vault decrypted from cold) —
and write `TestEvidence/restore-drill-2026-MM-DD.md` with measured RTO/RPO,
result, issues found, and follow-up actions. This task is the exit criterion
for the workplan: no drill evidence, not finished.
## Incident playbooks (R3, R4, R5, R6, R7)
```task
id: DISCTL-WP-0002-T07
status: todo
priority: medium
```
Write the five playbooks under `IncidentPlaybooks/`: ransomware/hostile access,
credential leak, accidental delete / data corruption, provider outage
(Bubble/Stripe/OpenRouter/DNS/email), loss of admin identity. Keep each to one
page of numbered steps per the spec (§6).