Service levels and resilience
Operational Runway
What an operator needs before this platform can be run by someone other than the people who built it. more
Health and tokens
GET /api/health returns the same reading, with no data and no secrets
Environment sandbox
Synthetic data only. Seed and reseed freely. Machine tokens may be unset, which shuts the SCIM and outbox endpoints.
The full rules for sandbox, staging and production are in docs/ENVIRONMENTS.md.
SCIM_TOKEN
/api/scim/v2/* · Directory provisioning from the client identity provider.
OUTBOX_TOKEN
/api/outbox · The pull-only outbox, collected by a job inside the client estate.
Backup and restore
Logical backups, checksummed, restored only into an empty database
scripts/ops/backup.sh writes a custom-format dump of all 178 tables and a checksum file beside it. It only reads from the database.
scripts/ops/restore.sh <file> <target> --confirm checks the checksum, refuses the database named in DATABASE_URL, refuses any target that already has tables, and only then restores.
The platform does not schedule backups itself. The host or the client database service runs backup.sh on a schedule; docs/ENVIRONMENTS.md asks for at least daily in production.
Incident playbooks
docs/RUNBOOK.md, with the first fifteen minutes and a review template
P1Application down or health endpoint failing
SEV-1P2Audit chain reports a break
SEV-1P3Suspected cross-tenant data exposure
SEV-1P4Machine token leaked
SEV-2P5Database restore needed
SEV-2P6Outbox backlog not being collected
SEV-3What ships with the code
Read in this order by a new operator
docs/RUNBOOK.md
Severity levels, first fifteen minutes, the six incident playbooks, and post-incident review.
docs/ENVIRONMENTS.md
Sandbox, staging and production: what data each holds, which tokens it gets, how a release moves.
docs/SUPPORT.md
Who answers what, the intake form for a ticket, response targets, and what support will never do.
CHANGELOG.md
Release notes, newest first. The version at the top matches the health endpoint.
scripts/ops/backup.sh
Logical backup to a checksummed file. Read-only against the database.
scripts/ops/restore.sh
Restore into an empty database only. Refuses the live database and any non-empty target.
Actions
What is waiting on a person
Running this in production needs a few things a person has to set. more
Operations
What this desk is allowed to start
A surface that only reports is not operable. more
Trigger and bound
The runway covers health, environment, tokens, backups and the release. more
Live observability
What the record shows right now
Operating tokens by state. Each token is set or not.
Current distribution
2 tokens
Is policy and strategy coming to fruition
Whether the written intent is holding here
Not yet. Operating tokens are still unset.
Not holding on the record
The intent is a platform a client team can run without its builders. more