Business continuity and disaster recovery, the program view¶
The split that organizes everything here: what is rebuildable from code, and what is actual state. Rebuildable things have a recovery plan of one line, apply it again; state has objectives, procedures, and drills, and a drill that has not run recently is a hope, so every drill row carries the date it last ran and goes stale on a schedule.
Rebuildable from code¶
| Component | Recovery | Evidence |
|---|---|---|
| Every repository | Clone again; the platform holds them and local clones are working copies | Git's design |
| The compose stack | docker compose up --build from a fresh clone |
The fresh-clone drill, run for real |
| The local cluster and its workload | Two scripts from a fresh clone | The cluster drills in the application repository |
| The cloud enclave | Reapply the stack; it is destroyed daily on purpose, so recovery is rehearsed by routine | Arrives at Phase 3 with the teardown drill |
Actual state¶
| Component | Objectives | Procedure | Last drill |
|---|---|---|---|
| The application database | A daily dump bounds loss to one day; restore in minutes | Dated compressed dump, restore with the application stopped, verify by restoring into a throwaway database and comparing counts; printed in the application repository | August 19, 2026, counts matched |
| Retention of those dumps | Thirty daily, twenty-four monthly | The application repository's backup section | Same drill |
| Terraform state | Versioned bucket; loss means re-import toil, not data loss | Arrives at Phase 3 with the state backend | Not yet standing |
| The organization trail | The record of record; bucket locked against deletion | Arrives at Phase 3 | Not yet standing |
| Credentials and keys | Hardware keys with a spare enrolled; recovery codes held offline; the agent's key revocable in one click and reissuable in minutes | Provider re-enrollment | Enrollment tested August 19, 2026 |
The enforcement¶
A recovery plan rots silently, which is why this document's drill dates are attestation rows in the platform baseline framework: each expires on its schedule, and an expired drill is a red check, not a memory. The schedule starts honest and small: the database restore drill quarterly, the fresh-clone drill at every phase close, the enclave rebuild daily by design.