root
f5175f1ce0
- audit/phase-one + phase-two: security audit briefs, findings, credential-rotation plan, Docker-USER hardening scripts, rollback refs - disaster-recovery/restore-test-log.md + backup-dr-audit-2026-08-10.md - clients/ (modelortho SEO audit, ai-biz-dev competitive landscape), notes/ (tiktok strategy) - projects/: front-desk-voice-agent, seo-visibility-checker product plan, hotnow-savannah HTML, resend-transactional-email, backup-dashboard-enhancements, code-review-graph, seo-ci-architecture - proposals/verdicttank/: architecture v4.0, methodology, judge-pool review, consolidation reasoning, cross-check review - docs/super-search/firecrawl-provider-strategy.md - updates: CHANGELOG, model-chain, projects-master-readme, intelsight.io - .gitignore: exclude nested standalone repos (seo-tool, venturebuilt)
4.1 KiB
ITPP Phase Two - Remediation Cost Estimate
Date: 2026-08-13 Status: AWAITING GERMAINE APPROVAL (C7 + C3 pre-approved fast-track, already executing) Conductor: Sho'Nuff
Anchor (Phase One actuals, for calibration)
Phase One was a read-only audit of 6 hosts plus the repo estate. From brief.md and the final report:
- Approved estimate: subtotal ~$5.40
- Realistic range: $8-10
- Ceiling: ~$13
- Actual: exceeded the ceiling. Driven by claude-sonnet-5 subagent usage and re-runs from 429 rate-limit failures.
- 7-day estate-wide DeepSeek total: $61.81 (all usage, not audit-only).
Phase Two is live-change remediation (investigate, change, verify, rollback-test, log), roughly 2-4x the per-unit cost of a read-only finding. The estimate below carries margin because Phase One actuals exceeded estimate. Under the $20/day cap, this spreads across ~8-12 execution days.
Effort labels are taken verbatim from the Phase One report recommendations table (S = under 1h, M = half day, L = 1-2 days, XL = multi-day).
Workstream 1 - Critical findings (itemized, per requirement)
| Item | Finding (report ref) | Effort | Estimate |
|---|---|---|---|
| C1 | Docker published-port UFW bypass, ~20 public consoles | M-L | $5-14 |
| C4 | Plaintext credentials, inventory + rotate + vault | L-XL | $12-28 |
| C5 | LiteLLM Postgres backup gap (pg_dump wrong DB name) | S-M | $2-5 |
| C6 | app3 shared MySQL, no tenant boundary (~24 sites) | L-XL | $12-28 |
| C8 | wphost02 backup gap + decommission (split-brain) | M | $3-8 |
| C9 | Warm standby state-DB sync (RPO ~28d stale) | M | $3-8 |
| C10 | Single shared SSH key, passwordless root (Indep D4) | M | $3-8 |
| D3 | Public repo re-leaks admin creds (EX-001, deferred) | M | $3-8 |
| C3 | Wazuh agents on 5 hosts (FAST-TRACK, in progress) | M | $3-8 |
| C7 | Grafana rotate + Tailscale (FAST-TRACK, in progress) | S | $1-3 |
WS1 subtotal: ~$47-118
Workstreams 2-6 (workstream-level)
Scope drawn from Phase One report sections noted.
| Workstream | Scope (report ref) | Estimate |
|---|---|---|
| WS2 - High findings | MFA enforcement (Gitea/CloudPanel/Vaultwarden/Grafana, report #11), fail2ban + unattended-upgrades + auditd (#12), backup gaps + restore-tests (#13), UNMS to UISP + image pinning (#14), port 8200 + runaway processes + gateway systemd (#15), retire NOPASSWD:ALL for named sudo (#10) | $20-50 |
| WS3 - Segmentation | C2 Tailscale ACL tags + three-tier model (internal/client/product) from report section 6 | $12-28 |
| WS4 - Git reorg | Repo estate cleanup (report 2.3) + private-repo credential exposures (Git-A) | $5-14 |
| WS5 - Documentation | Say-do gap fixes across 12 doc sections (report section 5) | $3-10 |
| WS6 - Operationalize P&P | Stand up Running Exemptions doc + change-management cadence (bootstrapped) | $3-10 |
WS2-6 subtotal: ~$43-112
Independence / verification buffer
Conductor independence checks (Sonnet 5) on consequential live-change "is this safe to do live" calls, per the Phase One mitigation pattern: $6-12
Totals
| Line | Range |
|---|---|
| WS1 (Critical) | $47-118 |
| WS2-6 | $43-112 |
| Independence buffer | $6-12 |
| TOTAL | ~$96-242 (midpoint ~$170) |
Pacing: ~8-12 days at the $20/day cap. No opus-tier models; primary DeepSeek V4 Pro, Sonnet 5 only for independence checks.
Scope-variance flags (flag before absorbing)
- C4 inventory may be larger than the report captured (6,296 Core / 5,504 app1-bu / 1,275 app2 secret-sprawl hits need per-file triage).
- C6 app3 DB segmentation is structural and may surface new per-tenant requirements mid-flight.
- D3 depends on Germaine's repo decision (currently deferred as EX-001).
- C1 on app1 is LiteLLM-adjacent (Hermes's own inference path); fallback chain will be used and logged.
Pre-flight confirmation
- Fallback chain verified intact: primary = admin-ai (LiteLLM on app1); fallbacks = deepseek (direct api.deepseek.com), google, xai, anthropic, openai, all configured direct.
- C7 (Core) and C3 (agent enrollment, manager ports already published) are NOT LiteLLM-adjacent; no fallback switch required.