Operate · item 27

Platform continuity

Continuity of the platform is held separately from continuity of the functions it runs, because the two fail differently. A function fails when work stops. The platform can fail while every queue keeps moving — observability goes dark and the work carries on unwatched, or the evidence store stops writing and the work carries on unprovable. Those failures need their own inventory, their own tiers and their own drills.

Drill record

Health

What survives the loss of a component

Components with a proven, partial or unproven recovery path, and the lines that cannot be reversed.

Platform components

5 tier 1 · 4 tier 2 · 2 tier 3

Single points of failure

4 of them are tier 1

Failover never tested

2 have no failover path at all

Recovery proven by test

1 of 11

7 unproven · the rest partly proven

Vendor lock recorded

2 of them have no exit plan written

Tier 1 with a proven time

3 of 5

Everything stops without a tier 1 component

Why this register is separate

Function continuity asks what happens to invoices, hires and orders when a line goes down, and the answer is usually a manual fallback and a backlog. Those questions are answered per line on the drill record.

Platform continuity asks a different question: what happens when the machinery that runs, watches and proves the work goes down. The worst platform failures are silent. Losing observability does not stop a single transaction — it stops anyone from knowing whether the transactions were right, and the estate keeps running at full speed with nobody watching.

Tier 1 — Everything stops without it.

5 components

Agent orchestratorUnproven

Execution layer · serves 14 of 14 functions · owner Yusuf Adeyemi

Schedules and runs every agent on the estate, holds the autonomy ceiling and enforces the stop.

Recovery time

never proven

target 15 min

Recovery point

under a minute

target, not a measurement

Active-passivefailover never testedsingle point of failure

A single orchestrator serves all fourteen functions. There is no partitioned deployment, so an orchestrator failure is an estate-wide event rather than a function-level one.

degraded mode — Agents stop. Work does not disappear; it queues at the last completed stage and is visible in the work tracker. Humans can still approve items already in front of them.

blast radius — All fourteen functions, all 475 lines, immediately.

depends on primary-db · model-gateway · identity

DRL-011 · kill switchscheduled

scheduled Sep 21, 2026 · next due Sep 21, 2027

last reviewed 21 days ago

Model gatewayPartly proven

Execution layer · serves 14 of 14 functions · owner Yusuf Adeyemi · Primary model provider

Routes every inference request, holds model versions and enforces the per-consumer spend cap.

Recovery time

22 min

target 15 min

Recovery point

under a minute

target, not a measurement

Active-passivefailover tested 26 days ago

degraded mode — Inference stops estate-wide. Deterministic stages continue. Anything requiring judgment queues. Two functions currently give the user no explanation, which is an open drill finding.

blast radius — All fourteen functions. Proven recovery of 22 minutes against a 15-minute target.

depends on identity · observability

vendor lock — Prompts and evaluation sets are written against the behavior of one provider. A forced switch would require re-evaluation of every agent, and no such re-evaluation has been costed. Exit plan: Secondary provider is configured and reachable. It has never carried production volume.

DRL-001 · failoverexecuted

last run Jul 23, 2026 · next due Oct 21, 2026

last reviewed 26 days ago

Evidence storePartly proven

Assurance layer · serves 14 of 14 functions · owner Grace Abbott

Append-only record of every action, with the hash chain that makes the record checkable.

Recovery time

3.3 hrs

target 4.0 hrs

Recovery point

15 min

target, not a measurement

Backup and restorefailover tested 2 months agosingle point of failure

One store, one chain. If it is lost and the backup is stale, the missing evidence cannot be reconstructed from anywhere else, because it is by design the only copy of what happened.

degraded mode — Work continues and evidence is buffered. If the buffer fills, work must stop rather than proceed unrecorded, which is the intended behavior and has never been exercised.

blast radius — Assurance across all functions. Operations continue for a period; auditability does not.

depends on primary-db

DRL-002 · restore from backupexecuted

last run Jun 25, 2026 · next due Oct 23, 2026

last reviewed 2 months ago

Primary data storePartly proven

Foundation layer · serves 14 of 14 functions · owner Yusuf Adeyemi · Managed database provider

Holds estate state: units, workflows, grants, controls and every ledger the product renders.

Recovery time

1.7 hrs

target 2.0 hrs

Recovery point

30 min

target, not a measurement

Active-passivefailover never testedsingle point of failure

Single primary with a read replica. A live cutover has never been performed.

degraded mode — The estate is read-only at best and unavailable at worst. Nothing progresses.

blast radius — Everything.

no upstream platform dependency

vendor lock — Standard interfaces, low lock-in. Migration cost is operational rather than structural. Exit plan: Documented export and restore path. Never rehearsed at full size.

DRL-013 · restore from backupexecuted

last run May 28, 2026 · next due Aug 26, 2026

last reviewed 3 months ago

Identity and accessUnproven

Foundation layer · serves 14 of 14 functions · owner Yusuf Adeyemi

Authenticates humans, resolves roles and tenancy, and gates every write to the estate.

Recovery time

never proven

target 30 min

Recovery point

under a minute

target, not a measurement

No failover pathfailover never testedsingle point of failure

Enterprise sign-on is built and not connected. The estate currently depends on the local credential path, which is a single mechanism with no alternate.

degraded mode — No human can sign in. Agents holding valid authority continue until their grants expire, which is an uncomfortable property rather than a designed one.

blast radius — All human action across all functions. Agent action continues, unsupervised.

no upstream platform dependency

DRL-006 · failoverscheduled

scheduled Aug 6, 2026 · next due Feb 2, 2027

last reviewed 12 days ago

Tier 2 — A capability is lost and processing continues.

4 components

Connector hubProven by test

Integration layer · serves 14 of 14 functions · owner Daniel Okoye

Holds the 26 source-system connectors, their sync schedules and their freshness state.

Recovery time

14 min

target 20 min

Recovery point

60 min

target, not a measurement

Active-activefailover tested 2 months ago

degraded mode — Affected lines fail closed rather than proceeding on stale reads. Proven in a drill; two lines gave no user-facing explanation.

blast radius — Scoped to the functions whose systems are affected. This is the one tier-1-adjacent component that degrades locally rather than globally.

depends on primary-db · identity

DRL-009 · failoverexecuted

last run Jun 16, 2026 · next due Sep 14, 2026

last reviewed 2 months ago

ObservabilityUnproven

Operations layer · serves 14 of 14 functions · owner Yusuf Adeyemi · Managed observability provider

Metrics, alarms and the operational view of the estate.

Recovery time

never proven

target 60 min

Recovery point

60 min

target, not a measurement

Backup and restorefailover never testedsingle point of failure

A single pipeline. If it is lost, the estate keeps running and nobody can see it.

degraded mode — Work continues normally. Detection stops. Every service level on this page becomes unmeasurable for the duration, and breaches inside the window would be found late or not at all.

blast radius — Detection across the whole estate. Operations are unaffected, which is exactly what makes it dangerous.

depends on primary-db

vendor lock — Query language and dashboards are provider-specific. Rebuilding elsewhere is weeks of work. No exit plan is written.

DRL-015 · tabletopoverdue

scheduled Aug 9, 2026 · next due Feb 5, 2027

last reviewed 9 days ago

Work queueUnproven

Execution layer · serves 14 of 14 functions · owner Yusuf Adeyemi

Holds in-flight work between stages and preserves ordering and idempotency.

Recovery time

never proven

target 10 min

Recovery point

under a minute

target, not a measurement

Active-activefailover never tested

degraded mode — Work stops moving between stages. Nothing is lost. Recovery is a restart rather than a rebuild.

blast radius — All lines, briefly.

depends on primary-db

no drill on the calendar covers this component

last reviewed 2 months ago

Notification and escalation deliveryUnproven

Operations layer · serves 14 of 14 functions · owner Avery Chen · Managed delivery provider

Delivers escalations to the named human and carries the response deadline.

Recovery time

never proven

target 15 min

Recovery point

under a minute

target, not a measurement

No failover pathfailover never testedsingle point of failure

One delivery path. If it fails silently, escalations are raised and nobody is told, and the escalation ledger will show them as open rather than as undelivered.

degraded mode — Escalations accumulate in the inbox and no one is notified. The work is visible to anyone who looks and invisible to anyone who does not.

blast radius — Every human-in-the-loop path on the estate.

depends on identity

vendor lock — Low. No exit plan is written.

no drill on the calendar covers this component

last reviewed 2 months ago

Tier 3 — Convenience or reporting only.

2 components

Document renderingUnproven

Operations layer · serves 14 of 14 functions · owner Grace Abbott · Managed rendering service

Produces evidence packs and auditor documents on demand.

Recovery time

never proven

target 4.0 hrs

Recovery point

1.0 days

target, not a measurement

Backup and restorefailover never tested

degraded mode — Evidence packs cannot be generated. The underlying evidence is unaffected and packs can be produced later.

blast radius — Audit and discovery response only. No operational impact.

depends on evidence-store

vendor lock — Low. The input is standard markup. Exit plan: Documented. Rendering can be moved without changing the evidence format.

no drill on the calendar covers this component

last reviewed 4 months ago

Sandbox estateUnproven

Operations layer · serves 14 of 14 functions · owner Grace Abbott

Holds the 151-unit non-production estate used for drills and rehearsals.

Recovery time

never proven

target 1.0 days

Recovery point

1.0 days

target, not a measurement

Backup and restorefailover never tested

degraded mode — Drills cannot be run. Production is unaffected, and the drill calendar stops, which is how a resilience program quietly decays.

blast radius — Rehearsal capability only.

depends on primary-db

no drill on the calendar covers this component

last reviewed 39 days ago

Platform drills on the calendar

7 drills scoped to the platform rather than to a function

DRL-001 · Model gateway failover under loadExecuted

failover · recovery time 22 min against 15 min · executed Jul 23, 2026

Recovered in 22 minutes against a 15-minute target. No work was lost because in-flight requests were queued rather than dropped. The miss was entirely in secondary capacity warm-up.

DRL-002 · Evidence store restore from backupExecuted

restore from backup · recovery time 3.3 hrs against 4.0 hrs · executed Jun 25, 2026

Restored inside the time target and outside the recovery point target. Forty-three evidence records written in the final 41 minutes before the simulated loss were not in the backup and could not be reconstructed. The chain verified from genesis after the restore, which was the primary thing being tested.

DRL-006 · Identity provider outageScheduled

failover · recovery time not measured against 30 min · scheduled Aug 6, 2026

DRL-009 · Connector hub degraded readExecuted

failover · recovery time 14 min against 20 min · executed Jun 16, 2026

The estate failed closed in 14 minutes against a 20-minute target. No work proceeded on stale data. Two lines produced no user-facing explanation of why they had stopped.

DRL-011 · Agent platform kill switch, estate wideScheduled

kill switch · recovery time not measured against 10 min · scheduled Sep 21, 2026

DRL-013 · Database point-in-time recoveryExecuted

restore from backup · recovery time 1.7 hrs against 2.0 hrs · executed May 28, 2026

Recovered inside both targets. The drill was run against a restored copy rather than by failing the live store, so it proves the backup is good and does not prove the failover is.

DRL-015 · Observability blackoutOverdue

tabletop · recovery time not measured against 60 min · scheduled Aug 9, 2026

Actions

What is waiting on a person

Continuity work is slow and nobody asks for it until the day it matters. These are the items that would hurt.

Build a reversal path for a business line

Work in this line cannot currently be undone.

Prove a recovery path

Designed for failover, never demonstrated.

Remove a single point of failure

One component whose loss stops the service.

Give a component a failover mode

No failover of any kind is configured.

Operations

What this desk is allowed to start

A surface that only reports is not operable. This is the work this page can set in motion, and the bound it runs into.

Trigger and bound

This desk can start a component assessment and record a proven recovery objective against evidence from a drill. It cannot trigger a failover, change an architecture, or declare a component resilient without a rehearsal behind it.

Live observability

What the record shows right now

Component recovery status. Proven means a rehearsal met the stated objective.

Current distribution

11 components

Proven19%

Partial327%

Unproven764%

Is policy and strategy coming to fruition

Whether the written intent is holding here

1 of 11 components have a proven recovery path. 6 remain single points of failure.

Not holding on the record

The written intent is that this platform can lose any one component and keep running. That is not yet demonstrated: 7 of 11 components are unproven, 2 have no failover mode configured and 6 are single points of failure. Separately, 93 business lines have no reversal path at all and 118 can only be partly reversed — which means for those lines a recovery restores the system without restoring the work.

What this page is, and what it is not

Drill results are measured against a modeled estate on a rehearsal calendar of our own making. Recovery times here are real measurements of a simulation, not evidence that a customer's production estate recovers in the same time.

6 of the 11 platform components are single points of failure, 4 of them tier 1. 8 have a failover path that has never been exercised and 2 have no failover path at all. Those are stated as findings, not as a maturity score.

Recovery point targets on this page are targets. Only recovery time has been measured, and only on the components with a proven figure — everywhere else the field reads never proven rather than showing the target as though it were an outcome.

Vendor lock is recorded on 5 components and 2 of those have no exit plan written down. Portability is a continuity question, not a procurement one, which is why it sits here.