Operate · item 27
Platform continuity
Continuity of the platform is held separately from continuity of the functions it runs, because the two fail differently. more
Health
What survives the loss of a component
Components with a proven, partial or unproven recovery path, and the lines that cannot be reversed.
Why this register is separate
Function continuity asks what happens to invoices, hires and orders when a line goes down, and the answer is usually a manual fallback and a backlog. more
Platform continuity asks a different question: what happens when the machinery that runs, watches and proves the work goes down. more
Tier 1 — Everything stops without it.
5 components
Agent orchestratorUnproven
Execution layer · serves 14 functions · owner Yusuf Adeyemi
Schedules and runs every agent on the estate, holds the autonomy ceiling and enforces the stop.
Recovery time
never proven
target 15 min
Recovery point
under a minute
target, not a measurement
Active-passivefailover never testedsingle point of failure
A single orchestrator serves every function. more
degraded mode — Agents stop. Work does not disappear; it queues at the last completed stage and is visible in the work tracker. Humans can still approve items already in front of them.
blast radius — Every function, all 475 lines, immediately.
depends on primary-db · model-gateway · identity
DRL-011 · kill switchscheduled
scheduled Sep 21, 2026 · next due Sep 21, 2027
last reviewed 21 days ago
Model gatewayPartly proven
Execution layer · serves 14 functions · owner Yusuf Adeyemi · Primary model provider
Routes every inference request, holds model versions and enforces the per-consumer spend cap.
Recovery time
22 min
target 15 min
Recovery point
under a minute
target, not a measurement
Active-passivefailover tested 26 days ago
degraded mode — Inference stops estate-wide. Deterministic stages continue. Anything requiring judgment queues. Two functions currently give the user no explanation, which is an open drill finding.
blast radius — Every function. Proven recovery of 22 minutes against a 15-minute target.
depends on identity · observability
vendor lock — Prompts and evaluation sets are written against the behavior of one provider. A forced switch would require re-evaluation of every agent, and no such re-evaluation has been costed. Exit plan: Secondary provider is configured and reachable. It has never carried production volume.
DRL-001 · failoverexecuted
last run Jul 23, 2026 · next due Oct 21, 2026
last reviewed 26 days ago
Evidence storePartly proven
Assurance layer · serves 14 functions · owner Grace Abbott
Append-only record of every action, with the hash chain that makes the record checkable.
Recovery time
3.3 hrs
target 4.0 hrs
Recovery point
15 min
target, not a measurement
Backup and restorefailover tested 2 months agosingle point of failure
One store, one chain. more
degraded mode — Work continues and evidence is buffered. If the buffer fills, work must stop rather than proceed unrecorded, which is the intended behavior and has never been exercised.
blast radius — Assurance across all functions. Operations continue for a period; auditability does not.
depends on primary-db
DRL-002 · restore from backupexecuted
last run Jun 25, 2026 · next due Oct 23, 2026
last reviewed 2 months ago
Primary data storePartly proven
Foundation layer · serves 14 functions · owner Yusuf Adeyemi · Managed database provider
Holds estate state: units, workflows, grants, controls and every ledger the product renders.
Recovery time
1.7 hrs
target 2.0 hrs
Recovery point
30 min
target, not a measurement
Active-passivefailover never testedsingle point of failure
Single primary with a read replica. A live cutover has never been performed.
degraded mode — The estate is read-only at best and unavailable at worst. Nothing progresses.
blast radius — Everything.
no upstream platform dependency
vendor lock — Standard interfaces, low lock-in. Migration cost is operational rather than structural. Exit plan: Documented export and restore path. Never rehearsed at full size.
DRL-013 · restore from backupexecuted
last run May 28, 2026 · next due Aug 26, 2026
last reviewed 3 months ago
Identity and accessUnproven
Foundation layer · serves 14 functions · owner Yusuf Adeyemi
Authenticates humans, resolves roles and tenancy, and gates every write to the estate.
Recovery time
never proven
target 30 min
Recovery point
under a minute
target, not a measurement
No failover pathfailover never testedsingle point of failure
Enterprise sign-on is built and not connected. more
degraded mode — No human can sign in. Agents holding valid authority continue until their grants expire, which is an uncomfortable property rather than a designed one.
blast radius — All human action across all functions. Agent action continues, unsupervised.
no upstream platform dependency
DRL-006 · failoverscheduled
scheduled Aug 6, 2026 · next due Feb 2, 2027
last reviewed 12 days ago
Tier 2 — A capability is lost and processing continues.
4 components
Connector hubProven by test
Integration layer · serves 14 functions · owner Daniel Okoye
Holds the 26 source-system connectors, their sync schedules and their freshness state.
Recovery time
14 min
target 20 min
Recovery point
60 min
target, not a measurement
Active-activefailover tested 2 months ago
degraded mode — Affected lines fail closed rather than proceeding on stale reads. Proven in a drill; two lines gave no user-facing explanation.
blast radius — Scoped to the functions whose systems are affected. This is the one tier-1-adjacent component that degrades locally rather than globally.
depends on primary-db · identity
DRL-009 · failoverexecuted
last run Jun 16, 2026 · next due Sep 14, 2026
last reviewed 2 months ago
ObservabilityUnproven
Operations layer · serves 14 functions · owner Yusuf Adeyemi · Managed observability provider
Metrics, alarms and the operational view of the estate.
Recovery time
never proven
target 60 min
Recovery point
60 min
target, not a measurement
Backup and restorefailover never testedsingle point of failure
A single pipeline. If it is lost, the estate keeps running and nobody can see it.
degraded mode — Work continues normally. Detection stops. Every service level on this page becomes unmeasurable for the duration, and breaches inside the window would be found late or not at all.
blast radius — Detection across the whole estate. Operations are unaffected, which is exactly what makes it dangerous.
depends on primary-db
vendor lock — Query language and dashboards are provider-specific. Rebuilding elsewhere is weeks of work. No exit plan is written.
DRL-015 · tabletopoverdue
scheduled Aug 9, 2026 · next due Feb 5, 2027
last reviewed 9 days ago
Work queueUnproven
Execution layer · serves 14 functions · owner Yusuf Adeyemi
Holds in-flight work between stages and preserves ordering and idempotency.
Recovery time
never proven
target 10 min
Recovery point
under a minute
target, not a measurement
Active-activefailover never tested
degraded mode — Work stops moving between stages. Nothing is lost. Recovery is a restart rather than a rebuild.
blast radius — All lines, briefly.
depends on primary-db
no drill on the calendar covers this component
last reviewed 2 months ago
Notification and escalation deliveryUnproven
Operations layer · serves 14 functions · owner Avery Chen · Managed delivery provider
Delivers escalations to the named human and carries the response deadline.
Recovery time
never proven
target 15 min
Recovery point
under a minute
target, not a measurement
No failover pathfailover never testedsingle point of failure
One delivery path. If it fails silently, escalations are raised and nobody is told, and the escalation ledger will show them as open rather than as undelivered.
degraded mode — Escalations accumulate in the inbox and no one is notified. The work is visible to anyone who looks and invisible to anyone who does not.
blast radius — Every human-in-the-loop path on the estate.
depends on identity
vendor lock — Low. No exit plan is written.
no drill on the calendar covers this component
last reviewed 2 months ago
Tier 3 — Convenience or reporting only.
2 components
Document renderingUnproven
Operations layer · serves 14 functions · owner Grace Abbott · Managed rendering service
Produces evidence packs and auditor documents on demand.
Recovery time
never proven
target 4.0 hrs
Recovery point
1.0 days
target, not a measurement
Backup and restorefailover never tested
degraded mode — Evidence packs cannot be generated. The underlying evidence is unaffected and packs can be produced later.
blast radius — Audit and discovery response only. No operational impact.
depends on evidence-store
vendor lock — Low. The input is standard markup. Exit plan: Documented. Rendering can be moved without changing the evidence format.
no drill on the calendar covers this component
last reviewed 4 months ago
Sandbox estateUnproven
Operations layer · serves 14 functions · owner Grace Abbott
Holds the 151-unit non-production estate used for drills and rehearsals.
Recovery time
never proven
target 1.0 days
Recovery point
1.0 days
target, not a measurement
Backup and restorefailover never tested
degraded mode — Drills cannot be run. Production is unaffected, and the drill calendar stops, which is how a resilience program quietly decays.
blast radius — Rehearsal capability only.
depends on primary-db
no drill on the calendar covers this component
last reviewed 39 days ago
Platform drills on the calendar
7 drills scoped to the platform rather than to a function
DRL-001 · Model gateway failover under loadExecuted
failover · recovery time 22 min against 15 min · executed Jul 23, 2026
Recovered in 22 minutes against a 15-minute target. more
DRL-002 · Evidence store restore from backupExecuted
restore from backup · recovery time 3.3 hrs against 4.0 hrs · executed Jun 25, 2026
Restored inside the time target and outside the recovery point target. more
DRL-006 · Identity provider outageScheduled
failover · recovery time not measured against 30 min · scheduled Aug 6, 2026
DRL-009 · Connector hub degraded readExecuted
failover · recovery time 14 min against 20 min · executed Jun 16, 2026
The estate failed closed in 14 minutes against a 20-minute target. more
DRL-011 · Agent platform kill switch, estate wideScheduled
kill switch · recovery time not measured against 10 min · scheduled Sep 21, 2026
DRL-013 · Database point-in-time recoveryExecuted
restore from backup · recovery time 1.7 hrs against 2.0 hrs · executed May 28, 2026
Recovered inside both targets. more
DRL-015 · Observability blackoutOverdue
tabletop · recovery time not measured against 60 min · scheduled Aug 9, 2026
Actions
What is waiting on a person
Continuity work is slow and nobody asks for it until the day it matters. more
Operations
What this desk is allowed to start
A surface that only reports is not operable. more
Trigger and bound
This desk can start a component assessment and record a proven recovery objective against evidence from a drill. more
Live observability
What the record shows right now
Component recovery status. Proven means a rehearsal met the stated objective.
Current distribution
11 components
Proven19%
Partial327%
Unproven764%
Is policy and strategy coming to fruition
Whether the written intent is holding here
1 of 11 components have a proven recovery path. 6 remain single points of failure.
Not holding on the record
The written intent is that this platform can lose any one component and keep running. more
What this page is, and what it is not
Drill results are measured against a modeled estate on a rehearsal calendar of our own making. more
6 of the 11 platform components are single points of failure, 4 of them tier 1. 8 have a failover path that has never been exercised and 2 have no failover path at all. Those are stated as findings, not as a maturity score.
Recovery point targets on this page are targets. more
Vendor lock is recorded on 5 components and 2 of those have no exit plan written down. Portability is a continuity question, not a procurement one, which is why it sits here.