docs(ops): Mission Control — the complete operations blueprint #5533
1 changed file+143−0
Addeddocs/MISSION-CONTROL-BLUEPRINT.md+143−0View fileUnifiedSplit
@@ -0,0 +1,143 @@
1# Mission Control — the operations blueprint (2026-08-26)
2
3Owner's ask: "the safest, most intelligent platform for all users — good
4clean design which suits everybody, easy clean interface for admin." This
5maps every operations lane: what EXISTS (verified this month, not
6believed), what's missing, and the build order. The doctrine underneath
7is Zero Noise (docs/VISION-ZERO-NOISE.md) + the Vapron spine principles:
8derived coverage, re-verified recovery, off-box watching, loud failure,
9probed docs, rot-checked exclusions.
10
11## 1. Mission Control — ONE admin home
12
13**Today:** /admin is a sprawl of good rooms with no hallway — spine,
14deploys, ops, mirrors, oauth-clients, users, servers… the owner has had
15to ask where things live (recorded feedback: check it exists, build it in).
16**Build:** a single landing board where every card is LIVE and
17click-through: platform truth score · open incidents · last deploy ·
18queue depths (CI, previews, repairs) · signal precision · backup/drill
19ages · fleet row per box (161, 158, future) · paging-channel health.
20Cards derive from registries — a new subsystem gets a card the day it
21exists or the coverage gap report flags it (Vapron principle 1).
22
23## 2. Ops & recovery
24
25**Exists:** deploy auto-rollback to last-good with served-SHA gate +
26FAILED_MARKER (forced-fail drill PASSED 2026-08-22) · nightly two-artifact
27backups, offsite, weekly restore drill from the offsite copy (green) ·
28runbooks in docs/ (cutover, 161 rebuild, operations) · manual-first
29operator surfaces (conflict panel, honest disabled AI buttons).
30**Missing:** incidents don't LINK their runbook (add `runbook:` anchor per
31incident class) · one-command box recovery script (the console recipes
32from the 2026-08-22 outages, scripted) · a third backup leg (object
33storage — keys are an owner item).
34
35## 3. System selftest
36
37**Exists:** the four-leg battery (production-readiness with armed
38privacy/authz gates · nav-audit · interaction-audit · full test suite) ·
39selfcheck engine with rot-checked suppressions · exclusion-rot ·
40design-audit · env-drift · copy-honesty · the AI-free-ship-path invariant
41suite.
42**Missing:** `bun run selftest` — one command, every leg, one verdict ·
43/admin/selftest rendering each gate's LAST RUN + age (a gate that hasn't
44run in a week is itself a red) · the render/overflow legs need a working
45browser home (the design-render estate job, below).
46
47## 4. Platform truth
48
49**Exists:** computed /status with merged-incident SLO windows · /guarantees
50with tests behind every claim · host-capabilities honest-degradation ·
51signal precision (collected, publication owner-gated) · PR ledger that
52cannot drift · verified identity + fork provenance.
53**Missing — the big one:** the TRUTH LEDGER. BUILD_BIBLE's ✅ measures
54artifact, not capability (mirroring was ✅ while 100% dead in prod).
55Every claimed feature gets: verifying artifact (test/probe/URL) + last
56verified WHEN + how. Rendered at /admin/truth; a claim whose verification
57is stale goes amber, missing goes red and fails CI. Vapron's hourly
58claim-truth checker, generalized to the whole feature map.
59
60## 5. Security & compliance
61
62**Exists:** push-time secret scan (with pragma discipline) · authz-matrix
63gate (142 routes × 3 identities, passing armed) · audit log + SIEM
64export · 2FA/passkeys · OIDC SSO + SCIM · OSV advisory feed · rulesets +
65protected tags + CODEOWNERS · signed-commit verification · runner env
66allowlist/denylist (secret containment) · DOCKER-USER tailnet fencing.
67**Missing:** SAML hardening (owner decision, unsold until then) ·
68incident-response runbook (who/what/when for a breach, not just an
69outage) · data-retention + deletion statement (deletion grace exists;
70write the policy the code already implements) · **compliance pack
71generator**: SOC2-style evidence (access reviews, drill logs, deploy
72history, audit trail) collected automatically from the artifacts we
73already produce — sellable-to-enterprise without a compliance team.
74
75## 6. Medic / spine doctor
76
77**Exists:** autoheal (container restarts) · deploy rollback · CI
78runner_restarted requeue · "escalated — no registered repair" honesty ·
79the load-guard.
80**Adopt (Vapron's medic contract):** a deterministic repair REGISTRY
81keyed by check name — allowlisted actions only (restart X, requeue Y,
82clear marker Z), every repair counts as recovered ONLY when the red check
83re-ran green, refusals recorded as outcomes with reasons. Plus the SPINE
84DOCTOR: a meta-check that every monitor itself ran recently — the watcher
85that watches the watchers' heartbeats (autopilot tick age, journey age,
86drill age).
87
88## 7. Paging
89
90**Exists:** severity-graded webhook fanout (Slack/ntfy-compatible,
91webhook-first so DB death still pages) · OnFailure= unit notifier ·
92dead-man hooks awaiting the healthchecks URL (owner) · mutual watch
93(peer:watch live once env lands; they card us already).
94**Missing:** a "page me now" test button in admin (paging you can't test
95is paging you don't have) · the WEEKLY PAGING DRILL — an automated
96synthetic page that verifies delivery end-to-end and reds when it doesn't
97arrive (alerting's rot-check) · a written escalation policy (even
98"founder, 24/7, these severities only at night" is a policy).
99
100## 8. Customer support infrastructure
101
102**Exists:** client error beacon + platform_errors on every document ·
103status subscriptions with confirmed email · /help + docs · founder
104support.
105**Build (founder-scale first, honest about it):** in-product "Report a
106problem" that pre-attaches the user's recent client errors (consented) ·
107support inbox on OWNED rails (the estate runs its own MTA + email-receive)
108· the SUPPORT CONSOLE in admin: look up a user → their repos, recent
109errors, gate runs, session state — every access AUDIT-LOGGED (support
110tooling that can't leak trust) · measured response-time on /status once
111there are customers (Vapron measures theirs; parity when real).
112
113## 9. Design that suits everybody
114
115**In flight:** full 558-render visual sweep · design-audit (49 banned
116purples mapped, sweep-to-zero then CI gate) · token discipline.
117**Complete the standard:** ONE admin shell — every /admin page in the
118same chrome, nav, and voice (admin-ops style) · dark mode first-class
119everywhere (developers live there) · accessibility as gates not
120intentions: contrast-ratio checking added to design-audit, keyboard
121navigation on every interactive surface, reduced-motion respected ·
122the empty-state warmth pass (every void teaches the next step).
123
124## 10. The intelligence layer (on top, never underneath)
125
126Signal precision published when earned · verified-before-shown skeptic
127pass (build-map #2) · AI incident responder (exists, D4) and AI repair
128PROPOSALS feeding the medic registry — the medic stays deterministic,
129AI suggests new rulebook entries for human adoption · everything sheds
130gracefully when AI is absent (the sovereignty invariant, tested).
131
132## Build order
133
1341. **Truth ledger** (§4) — the keystone; everything else reports into it.
1352. **Medic registry + spine doctor** (§6) — recovery that proves itself.
1363. **Paging test button + weekly paging drill** (§7) — cheap, closes the
137 "detected everything, told no one" class forever.
1384. **Mission Control board** (§1) — the hallway, once rooms report truth.
1395. **Selftest command + board** (§3).
1406. **Support console + report-a-problem** (§8) — lands with first users.
1417. **Compliance pack generator** (§5) — lands with first enterprise ask.
1428. **Admin shell unification + a11y gates** (§9) — continuous, with the
143 purple sweep and render-sweep findings.
0144
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts