# ITPP Phase Two - Remediation Cost Estimate

**Date:** 2026-08-13
**Status:** AWAITING GERMAINE APPROVAL (C7 + C3 pre-approved fast-track, already executing)
**Conductor:** Sho'Nuff

---

## Anchor (Phase One actuals, for calibration)

Phase One was a read-only audit of 6 hosts plus the repo estate. From `brief.md` and the final report:

- Approved estimate: subtotal ~$5.40
- Realistic range: $8-10
- Ceiling: ~$13
- **Actual: exceeded the ceiling.** Driven by claude-sonnet-5 subagent usage and re-runs from 429 rate-limit failures.
- 7-day estate-wide DeepSeek total: $61.81 (all usage, not audit-only).

Phase Two is **live-change remediation** (investigate, change, verify, rollback-test, log), roughly 2-4x the per-unit cost of a read-only finding. The estimate below carries margin because Phase One actuals exceeded estimate. Under the $20/day cap, this spreads across ~8-12 execution days.

Effort labels are taken verbatim from the Phase One report recommendations table (S = under 1h, M = half day, L = 1-2 days, XL = multi-day).

---

## Workstream 1 - Critical findings (itemized, per requirement)

| Item | Finding (report ref) | Effort | Estimate |
|---|---|---|---|
| C1 | Docker published-port UFW bypass, ~20 public consoles | M-L | $5-14 |
| C4 | Plaintext credentials, inventory + rotate + vault | L-XL | $12-28 |
| C5 | LiteLLM Postgres backup gap (pg_dump wrong DB name) | S-M | $2-5 |
| C6 | app3 shared MySQL, no tenant boundary (~24 sites) | L-XL | $12-28 |
| C8 | wphost02 backup gap + decommission (split-brain) | M | $3-8 |
| C9 | Warm standby state-DB sync (RPO ~28d stale) | M | $3-8 |
| C10 | Single shared SSH key, passwordless root (Indep D4) | M | $3-8 |
| D3 | Public repo re-leaks admin creds (EX-001, deferred) | M | $3-8 |
| C3 | Wazuh agents on 5 hosts (FAST-TRACK, in progress) | M | $3-8 |
| C7 | Grafana rotate + Tailscale (FAST-TRACK, in progress) | S | $1-3 |

**WS1 subtotal: ~$47-118**

## Workstreams 2-6 (workstream-level)

Scope drawn from Phase One report sections noted.

| Workstream | Scope (report ref) | Estimate |
|---|---|---|
| WS2 - High findings | MFA enforcement (Gitea/CloudPanel/Vaultwarden/Grafana, report #11), fail2ban + unattended-upgrades + auditd (#12), backup gaps + restore-tests (#13), UNMS to UISP + image pinning (#14), port 8200 + runaway processes + gateway systemd (#15), retire NOPASSWD:ALL for named sudo (#10) | $20-50 |
| WS3 - Segmentation | C2 Tailscale ACL tags + three-tier model (internal/client/product) from report section 6 | $12-28 |
| WS4 - Git reorg | Repo estate cleanup (report 2.3) + private-repo credential exposures (Git-A) | $5-14 |
| WS5 - Documentation | Say-do gap fixes across 12 doc sections (report section 5) | $3-10 |
| WS6 - Operationalize P&P | Stand up Running Exemptions doc + change-management cadence (bootstrapped) | $3-10 |

**WS2-6 subtotal: ~$43-112**

## Independence / verification buffer

Conductor independence checks (Sonnet 5) on consequential live-change "is this safe to do live" calls, per the Phase One mitigation pattern: $6-12

---

## Totals

| Line | Range |
|---|---|
| WS1 (Critical) | $47-118 |
| WS2-6 | $43-112 |
| Independence buffer | $6-12 |
| **TOTAL** | **~$96-242 (midpoint ~$170)** |

Pacing: ~8-12 days at the $20/day cap. No opus-tier models; primary DeepSeek V4 Pro, Sonnet 5 only for independence checks.

## Scope-variance flags (flag before absorbing)

- **C4** inventory may be larger than the report captured (6,296 Core / 5,504 app1-bu / 1,275 app2 secret-sprawl hits need per-file triage).
- **C6** app3 DB segmentation is structural and may surface new per-tenant requirements mid-flight.
- **D3** depends on Germaine's repo decision (currently deferred as EX-001).
- **C1** on app1 is LiteLLM-adjacent (Hermes's own inference path); fallback chain will be used and logged.

## Pre-flight confirmation

- Fallback chain verified intact: primary = admin-ai (LiteLLM on app1); fallbacks = deepseek (direct api.deepseek.com), google, xai, anthropic, openai, all configured direct.
- C7 (Core) and C3 (agent enrollment, manager ports already published) are NOT LiteLLM-adjacent; no fallback switch required.