p24-infra Docs

2026-06-28-initial-12-domain-first-run

7 min read

Initial Compliance Audit — All 12 Domains (First Run)

Issue: #1972 Date: 2026-06-28 Ordered by: radieu Conducted by: claude (p24-infra worker session, bms-4) Policy: docs/playbooks/compliance-audit-policy.md Registry: public.dev_r_compliance_audits — one row per domain (12 rows)

Scope & honesty statement

This first run was conducted by an autonomous light worker with read-only access to the git repo, SOPS+age decryption (canary only), the Supabase REST API, and the GitHub API. It did not have a verified, supervised path to perform live multi-server SSH operations, MongoDB / psql profiling, Trivy scans, Prometheus/Grafana queries, or destructive operations (backup restore tests, DR drills).

To keep the compliance registry trustworthy, no domain was stamped pass/fail on a check that was not actually executed. Domains that require live or destructive operations are recorded as deferred with an explicit reason and a next_audit_due date so the daily cron (compliance-audit-due-check.yml, PR #1973) and a future supervised session pick them up. Domains audited read-only are recorded as pass/partial with their genuine findings.

ResultDomainsCount
partial (genuinely audited, residual gaps)1, 2, 6, 7, 9, 116
deferred (needs live/destructive ops or data not reachable from worker)3, 4, 5, 8, 10, 126

Domain-by-domain results

Domain 1 — Credentials & Secrets · credential · partial

  • SOPS integrity — PASS. All 8 secrets/*.env.sops files decrypt cleanly (canary decrypt, exit-code only, no values printed): administration, art-agency, bms-servers, brandpilot, monitoring, n8n-bms4, vps-h1, whatsup.
  • Overdue rotations — PASS. Zero dev_r_services rows with next_due < 2026-06-28.
  • Completeness — PARTIAL → REMEDIATED (#1975, 2026-06-28). At audit time, 7 of 42 active credential rows lacked last_rotated and/or next_due (NEXT_PUBLIC_SUPABASE_ANON_KEY, DISCORD_WEBHOOK_URL, P24_DISCORD_SCRIPTS_ERRORS_WEBHOOK_URL, CLAUDE_MAX_OAUTH, NEXCON_API_KEY, GMAIL_OAUTH_CLIENT, N8N_CLOUD_API_KEY). All 7 backfilled — last_rotated set to the row’s created_at where no rotation was on record (conservative baseline), next_due = last_rotated + rotation_freq, with rotation_freq defaulted by type (API keys/OAuth 90d; webhook URLs / anon key 365d). 0/42 active credential rows now lack rotation fields; the overdue check still reports 0 rows with next_due < today.
  • Deferred sub-checks: key-isolation (no key shared by >2 consumers), rotation-log row integrity per rotation, “credentials only in .env.local/GH Secrets” — need cross-source reconciliation in a supervised session.
  • Gap issue: registry-hygiene (combined with Domain 2) — #1975, remediated.

Domain 2 — Infrastructure Changes · infrastructure · partial

  • dev_r_services completeness — PARTIAL → REMEDIATED (#1975, 2026-06-28). At audit time, of the active rows flagged compliance_workbook=no: 4 deployable frontends lacked a workbook (et-operational-platform-7ktl, p24-nextjs-v2026, et-lager, game-play) and rows lacked an element_type classification (24 at audit time; 34 by remediation time as the bms-1 container inventory had grown — the remediation covered the full current null set). Remediation: the 4 frontends reclassified to compliance_workbook=n/a with a per-row justification in compliance_notes (preview/pre-production/out-of-scope); element_type set on all remaining null active rows (25 bms-1 Pinbox24 containers → container, queue-issue-api → service, 3 scripts → script, 2 Claude workers → claude-agent, 1 workflow, 1 dashboard, 1 server). 0 active rows now lack element_type.
  • Deferred sub-checks: server OS versions, Docker image age/CVE, UFW allowlists on bms-2/bms-3, Cloudflare DNS hygiene, Ansible drift, vps-h1 protection — all require live SSH.
  • Gap issue: registry-hygiene (combined with Domain 1) — #1975, remediated.

Domain 3 — Backup & Disaster Recovery · infrastructure · deferred

Backup-restore test and bms-1 DR drill are destructive operations that must not be run unsupervised by an autonomous light worker. Supabase/Wasabi freshness and MongoDB RS health are covered by continuous Prometheus alerts (not re-verified here). Deferred to a supervised DR session.

Domain 4 — Security & Access Control · security · deferred

SSH authorized_keys across 6 servers, GitHub collaborator review, Cloudflare token-scope audit, and full Supabase RLS coverage require live SSH and admin-API access not verified from this worker. RLS on the audit table itself was observed correct (service_role + grafana_readonly only). Deferred.

Domain 5 — CVE & Container Security · security · deferred

Trivy scan results live in the GH Actions nightly trivy-scan.yml pipeline; base-image freshness and npm/pip audit were not executed from this worker. Deferred to the CVE pipeline / supervised run.

Domain 6 — EU AI Act Compliance · eu_ai_act · partial

  • Registry present: dev_r_ai_systems holds 12 systems, all with last_reviewed set.
  • Risk distribution: 6 minimal, 6 limited, 0 high-risk → Annex III high-risk obligations are not triggered; the 2026-08-02 deadline applies to high-risk systems (none present).
  • compliance_status: 4 compliant, 7 partial, 1 n/a — the 7 partial are documentation-completeness items on limited/minimal-risk systems (housekeeping, not legal jeopardy). docs/eu-ai-act-compliance.md present (254 lines).
  • Gap issue: track the 7 partial-status systems to compliant before 2026-08-02.

Domain 7 — Agent & Automation Health · tooling · partial

  • Worker queue / mutex — PASS (verified live). This session registered in agent_sessions, claimed the per-issue mutex via claim_task, and patched agent_tasks — the dispatch path is functional end-to-end.
  • Deferred sub-checks: n8n scheduled-workflow completeness, Claude runner OAuth freshness on both hosts, the 6 n8n Supabase credentials’ 200 OK validity — need live n8n/runner access.

Domain 8 — Cost Control · custom · deferred

Monthly infra cost (~655 EUR baseline ±15%), Claude API spend, and Wasabi growth require invoice/billing data and metrics not reachable from this worker. Deferred to the monthly cost review.

Domain 9 — Process & Playbook Consistency · process · partial

  • Decommissioned-tool consistency — PASS (verified). CLAUDE.md references Infisical only as “decommissioned 2026-06-21 — never use it”. docs/infisical-ce-operations.md carries a clear DECOMMISSIONED banner and is marked historical. Secondary docs (healthcheck-observability.md, sentry-operations.md, nightly-checks-triage.md) all reference Infisical as REMOVED. No stale active-use references found.
  • Memory hygiene — N/A. No memory/ directory in this repo (agent memory is per-host under ~/.claude, out of repo scope).
  • Deferred sub-check: the full quarterly 10% playbook-accuracy spot-check against live system state was not completed (needs live verification).

Domain 10 — Database Performance · infrastructure · deferred

pg_stat_statements slow-query/index/bloat analysis needs psql against the Supabase Postgres connection string on bms-4; MongoDB slow-op profiling needs mongosh on bms-2 PRIMARY. Neither was run from this worker. Deferred to a supervised DB-performance session.

Domain 11 — Audit & Incident History (Meta-Audit) · process · partial

  • Coverage — PARTIAL. Before this run, dev_r_compliance_audits held only 2 rows (audit_types credential, tooling). This first run adds the remaining domains, materially improving coverage. After this run, infrastructure, eu_ai_act, process, security, and custom types all have at least one row.
  • docs/secrets-rotation-log.md present; 52 exposure-tagged lines. A per-quarter forced-rotation trend analysis needs a manual parse — deferred sub-check.

Domain 12 — Infrastructure Expansion & Capacity · infrastructure · deferred

RAM/disk headroom, MongoDB rs0 growth runway, and worker-queue throughput are Prometheus/Grafana metrics not queried from this worker. bms-1 Ubuntu 20.04 EOL remains a known tracked exception. Deferred to the monthly capacity review.

Gaps raised (GitHub issues)

#GapDomainsSeverity
#1975 — resolveddev_r_services registry completeness: 7 credential rows missing rotation fields, 4 frontends missing workbook, 24 rows missing element_type1, 2MEDIUM
(linked in issue #1972 comment)EU AI Act: 7 AI systems at compliance_status=partial before 2026-08-026MEDIUM (legal/housekeeping)

Deferred domains do not get a “gap” issue — the deferred registry row plus its next_audit_due date is the tracking mechanism; a supervised session or the daily cron will execute them.

Follow-up / next runs

  • A supervised p24-infra session (with live SSH + psql + mongosh) should execute Domains 3, 4, 5, 8, 10, 12 and the deferred sub-checks of 1, 2, 7, 9, 11.
  • The daily cron compliance-audit-due-check.yml (PR #1973) will surface each domain as its next_audit_due arrives.

Conducted by the p24-infra worker agent for issue #1972. No secret values appear in this report.

Graph View