root
f5175f1ce0
- audit/phase-one + phase-two: security audit briefs, findings, credential-rotation plan, Docker-USER hardening scripts, rollback refs - disaster-recovery/restore-test-log.md + backup-dr-audit-2026-08-10.md - clients/ (modelortho SEO audit, ai-biz-dev competitive landscape), notes/ (tiktok strategy) - projects/: front-desk-voice-agent, seo-visibility-checker product plan, hotnow-savannah HTML, resend-transactional-email, backup-dashboard-enhancements, code-review-graph, seo-ci-architecture - proposals/verdicttank/: architecture v4.0, methodology, judge-pool review, consolidation reasoning, cross-check review - docs/super-search/firecrawl-provider-strategy.md - updates: CHANGELOG, model-chain, projects-master-readme, intelsight.io - .gitignore: exclude nested standalone repos (seo-tool, venturebuilt)
84 lines
4.1 KiB
Markdown
84 lines
4.1 KiB
Markdown
# ITPP Phase Two - Remediation Cost Estimate
|
|
|
|
**Date:** 2026-08-13
|
|
**Status:** AWAITING GERMAINE APPROVAL (C7 + C3 pre-approved fast-track, already executing)
|
|
**Conductor:** Sho'Nuff
|
|
|
|
---
|
|
|
|
## Anchor (Phase One actuals, for calibration)
|
|
|
|
Phase One was a read-only audit of 6 hosts plus the repo estate. From `brief.md` and the final report:
|
|
|
|
- Approved estimate: subtotal ~$5.40
|
|
- Realistic range: $8-10
|
|
- Ceiling: ~$13
|
|
- **Actual: exceeded the ceiling.** Driven by claude-sonnet-5 subagent usage and re-runs from 429 rate-limit failures.
|
|
- 7-day estate-wide DeepSeek total: $61.81 (all usage, not audit-only).
|
|
|
|
Phase Two is **live-change remediation** (investigate, change, verify, rollback-test, log), roughly 2-4x the per-unit cost of a read-only finding. The estimate below carries margin because Phase One actuals exceeded estimate. Under the $20/day cap, this spreads across ~8-12 execution days.
|
|
|
|
Effort labels are taken verbatim from the Phase One report recommendations table (S = under 1h, M = half day, L = 1-2 days, XL = multi-day).
|
|
|
|
---
|
|
|
|
## Workstream 1 - Critical findings (itemized, per requirement)
|
|
|
|
| Item | Finding (report ref) | Effort | Estimate |
|
|
|---|---|---|---|
|
|
| C1 | Docker published-port UFW bypass, ~20 public consoles | M-L | $5-14 |
|
|
| C4 | Plaintext credentials, inventory + rotate + vault | L-XL | $12-28 |
|
|
| C5 | LiteLLM Postgres backup gap (pg_dump wrong DB name) | S-M | $2-5 |
|
|
| C6 | app3 shared MySQL, no tenant boundary (~24 sites) | L-XL | $12-28 |
|
|
| C8 | wphost02 backup gap + decommission (split-brain) | M | $3-8 |
|
|
| C9 | Warm standby state-DB sync (RPO ~28d stale) | M | $3-8 |
|
|
| C10 | Single shared SSH key, passwordless root (Indep D4) | M | $3-8 |
|
|
| D3 | Public repo re-leaks admin creds (EX-001, deferred) | M | $3-8 |
|
|
| C3 | Wazuh agents on 5 hosts (FAST-TRACK, in progress) | M | $3-8 |
|
|
| C7 | Grafana rotate + Tailscale (FAST-TRACK, in progress) | S | $1-3 |
|
|
|
|
**WS1 subtotal: ~$47-118**
|
|
|
|
## Workstreams 2-6 (workstream-level)
|
|
|
|
Scope drawn from Phase One report sections noted.
|
|
|
|
| Workstream | Scope (report ref) | Estimate |
|
|
|---|---|---|
|
|
| WS2 - High findings | MFA enforcement (Gitea/CloudPanel/Vaultwarden/Grafana, report #11), fail2ban + unattended-upgrades + auditd (#12), backup gaps + restore-tests (#13), UNMS to UISP + image pinning (#14), port 8200 + runaway processes + gateway systemd (#15), retire NOPASSWD:ALL for named sudo (#10) | $20-50 |
|
|
| WS3 - Segmentation | C2 Tailscale ACL tags + three-tier model (internal/client/product) from report section 6 | $12-28 |
|
|
| WS4 - Git reorg | Repo estate cleanup (report 2.3) + private-repo credential exposures (Git-A) | $5-14 |
|
|
| WS5 - Documentation | Say-do gap fixes across 12 doc sections (report section 5) | $3-10 |
|
|
| WS6 - Operationalize P&P | Stand up Running Exemptions doc + change-management cadence (bootstrapped) | $3-10 |
|
|
|
|
**WS2-6 subtotal: ~$43-112**
|
|
|
|
## Independence / verification buffer
|
|
|
|
Conductor independence checks (Sonnet 5) on consequential live-change "is this safe to do live" calls, per the Phase One mitigation pattern: $6-12
|
|
|
|
---
|
|
|
|
## Totals
|
|
|
|
| Line | Range |
|
|
|---|---|
|
|
| WS1 (Critical) | $47-118 |
|
|
| WS2-6 | $43-112 |
|
|
| Independence buffer | $6-12 |
|
|
| **TOTAL** | **~$96-242 (midpoint ~$170)** |
|
|
|
|
Pacing: ~8-12 days at the $20/day cap. No opus-tier models; primary DeepSeek V4 Pro, Sonnet 5 only for independence checks.
|
|
|
|
## Scope-variance flags (flag before absorbing)
|
|
|
|
- **C4** inventory may be larger than the report captured (6,296 Core / 5,504 app1-bu / 1,275 app2 secret-sprawl hits need per-file triage).
|
|
- **C6** app3 DB segmentation is structural and may surface new per-tenant requirements mid-flight.
|
|
- **D3** depends on Germaine's repo decision (currently deferred as EX-001).
|
|
- **C1** on app1 is LiteLLM-adjacent (Hermes's own inference path); fallback chain will be used and logged.
|
|
|
|
## Pre-flight confirmation
|
|
|
|
- Fallback chain verified intact: primary = admin-ai (LiteLLM on app1); fallbacks = deepseek (direct api.deepseek.com), google, xai, anthropic, openai, all configured direct.
|
|
- C7 (Core) and C3 (agent enrollment, manager ports already published) are NOT LiteLLM-adjacent; no fallback switch required.
|