​

Bus-Factor & Recovery — Operator Continuity (G19)

Why this exists. Latimer-Woods-Tech is a solo-operator platform. If the operator (@adrper79-dot) is suddenly unavailable — illness, accident, travel without access — a trusted person must be able to keep the lights on and recover access. This is the single entry point for “the operator is gone; what now?”. It is a tour + index, not a replacement for the per-system runbooks it links. Closes: GAP_REGISTER.md G19. Companion: G20 (per-product backup/DR — RECOVERY.md), G18 (LEGAL_OPS.md). 🔲 = an operator-only fact that must be filled in by hand. Do not commit secrets here — store locations/pointers, never the credential itself.

​

0. First 10 minutes — if you just inherited this

1. Read §1 (what the platform is) and §2 (the critical-systems map).
2. Get into the password manager (🔲 which one + where the emergency kit lives) — this is the master key to everything else.
3. Confirm GitHub org access (Latimer-Woods-Tech) — that’s where all code + automation lives.
4. Confirm Cloudflare account access — that’s where every production service runs.
5. Check the daily Pushover digest / Sentry for active incidents (§4).
6. If something is actively down, jump to §4 (recovery procedures) — don’t improvise.

​

1. The 60-second tour — what this platform is

Other surfaces: apunlimited.com (admin-studio prod API), latimerwoods.dev (admin/QA), mysticapi.com (planned), wordis-bond (⚠️ TCPA regulatory hold — see docs/supervisor/FRIDGE.md rule 1; do not touch the UI).

​

2. Critical-systems map

Secret topology (important): CI secrets are not GitHub Actions repo secrets — they live in GCP Secret Manager (factory-495015) and are pulled at runtime via Workload Identity Federation (scripts/fetch_gcp_secrets.sh). So GCP access ≈ access to most keys. See runbooks/github-secrets-and-tokens.md.

​

3. Where things live (quick directory)

• What’s true right now: docs/STATE.md
• Non-negotiable operating rules: docs/supervisor/FRIDGE.md
• Every Worker + its URL + consumers: docs/service-registry.yml
• Known debt: docs/GAP_REGISTER.md
• All runbooks: docs/runbooks/
• Domains / legal / IP: docs/LEGAL_OPS.md

​

4. Recovery procedures (index — don’t improvise)

​

5. Designated trusted contact

• Name / relationship: 🔲
• Contact (phone + email): 🔲
• What they have today: 🔲 (e.g., emergency password-manager kit, knows where this doc is)
• What they are authorized to do: 🔲 (keep services running / rotate secrets / contact customers / nothing financial)
• Escalation order if unreachable: 🔲

​

6. Account & credential recovery vault

• Password manager emergency kit: 🔲 location (safe / sealed envelope / with trusted contact)
• 2FA backup codes (GitHub, Cloudflare, Stripe, GCP, Neon): 🔲 location
• Domain registrar logins: see LEGAL_OPS.md §1 · 🔲 recovery location
• Payment/payout account (Stripe) recovery: 🔲
• Phone/SIM (if 2FA is SMS-based — single point of failure): 🔲 carrier account + port-out PIN location

​

7. Annual fire drill

• Trusted contact follows §0 end-to-end without the operator’s help and reports what was missing.
• Restore one product database from backup (per G20 RECOVERY.md) and verify it boots.
• Rotate one non-critical secret using the runbook, start to finish.
• Confirm every 🔲 in this doc is still accurate.

​

8. If the operator is unavailable — decision tree

Is something actively DOWN?
  ├─ No  → do nothing destructive. Let automation run. Watch the daily Pushover digest.
  │        Re-evaluate in 24–48h. Most things self-heal or wait.
  └─ Yes → §4 runbook for that situation.
            ├─ Recoverable from a runbook?  → follow it exactly; write a postmortem (§4).
            └─ Not recoverable / financial / legal?  → contact the trusted contact (§5)
                 and, if it concerns customers or money, pause rather than guess.

Guiding principle: a paused service is recoverable; a wrong destructive action may not be. When unsure, stop and escalate.