coulomb/disaster-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
disaster-control/INTENT.md
tegwick 2f6f489289 Bootstrap resilience control plane: intent, risk analysis, first workplan 
- INTENT.md: purpose and boundaries of the resilience control plane
- specs/ResilienceControlSetup.md: design exploration (tiers, RTO/RPO, 3-2-1)
- history/2026-07-04-initial-risk-analysis.md: 12 failure modes ranked, mapped to artifacts
- workplans/DISCTL-WP-0002-resilience-foundation.md: registers, policy, first tested restore
- DISCTL-WP-0001 T03 (seed first real workplan) done

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-04 12:45:16 +02:00

1.9 KiB
Raw Blame History

INTENT

Purpose

disaster-control is the Resilience Control Plane for Coulomb Social / Helix Forge and adjacent endeavors. It is the single source of truth for recovery — independent of any one server — answering: what exists, what must survive, how it is rebuilt, and whether restore actually works.

The framing is business continuity + disaster recovery + cyber recovery + evidence, informed by ISO 22301, NIST CSF 2.0, NIST SP 800-34, and CISA backup guidance.

What lives here

  • Registers — AssetRegister.yaml, DataRegister.yaml, service dependency map
  • Policy — ResiliencePolicy.md, BackupPolicy.md, RTO/RPO matrix
  • Restore runbooks — full server loss, Gitea restore, k3s restore, Bubble export restore, breach recovery, secret rotation
  • Incident playbooks — ransomware, credential leak, accidental delete, provider outage, data corruption
  • Test evidence — dated restore-drill reports proving RTO/RPO are actually met

Operating principle

Every capability that becomes valuable must declare its source of truth, recovery method, backup schedule, RTO, RPO, owner, and restore test evidence.

Servers are disposable; data, identity, secrets, evidence, and payment/account records are not. Rebuild (Ansible/IaC + data restore + secret recovery + DNS cutover) is the default recovery pattern, not server resurrection.

Boundaries

This repo documents, plans, and evidences resilience for the Coulomb stack. It does not host application runtime code, and it does not own the backup tooling itself (restic, Velero, gitea dump, etc. run where the infrastructure lives). Extracting the control plane into a standalone product is explicitly deferred.

Current state

Early exploration: specs/ResilienceControlSetup.md outlines the full design (asset tiers, RTO/RPO targets, 3-2-1 + immutable backup architecture, playbooks, drill cadence). The registers, policies, runbooks, and evidence loop are not yet written.