FSD-FRM-03 — Service Acceptance Record
AI simulationv0.3
Fernbrook Software — internal. Confluence PLAT → Solution Development. Intake ticket PLAT-341 (front-door board: Acceptance). Template: FSD-FRM-03 (FitSD v0.3, adopted unmodified per Adoption Pack §3).
Header
| Field | Entry |
|---|---|
| Solution title | CertHub — certificate management service |
| Status | Accepted into service — with conditions (§3) — 2026-11-27 |
| Solution Owner | Priya Chandra |
| Delivery project (ref) | PLAT-341 (delivery epic PLAT-355; build changes in Jira CHANGE — CHG-2214, CHG-2258, CHG-2231/2232 et al.; renewals under standard change SC-CERT-01) |
| Linked Gate 2 (FSD-FRM-02) | S3-FRM-02 (this space) — approved 2026-09-08 with six conditions (position at §1a below) |
| Date | 2026-11-20 |
Submission note (PC): Gate 2’s milestone plan targeted 2026-11-06; actual submission is 2026-11-20. The two-week drift traces to the DNS-01 delegation slip (HLD DEC8 — one week) plus the failed first test restore forcing a backup redesign and re-test (Recovery §4 — one week). Both are evidenced below; neither was compressible without submitting on untested claims. The 2026-10-30 wildcard hard stop was met regardless (adopted 2026-10-28).
1. Acceptance criteria
Against the ratified SAC baseline (Adoption Pack §4), row by row, evidence linked. Applicability rules checked: none of the three N/A rules applies to CertHub (stateful; Tier 1; has paid dependencies) — no row is claimed N/A.
| Criterion | Evidence / link | Met? (Y / N / N/A per baseline) |
|---|---|---|
| Documentation: HLD, runbook, recovery procedure, operating procedures (SOPs), user/how-to published | All five published in Confluence PLAT → Service Docs → CertHub, linked from the service register entry: HLD (as built, incl. standing decision log per DEC7) · Runbook incl. incident profile + SOP-1…6 · Recovery procedure · User guide · Monitoring & incident profile · Rafi’s triage guide (runbook child page). Baseline names the documents; the SOP set is folded into the runbook §6 as its procedures — consistent with FitSD’s own definition of SOPs, flagged for the Approver in case a separate SOP artefact is expected. | Y |
| Backup (tested): backup in place and test restore performed, dated | Nightly CNPG barman-cloud (DB, authoritative) + Velero certhub-nightly, separate account/region, 35+12 retention, per SEC-03 — Recovery §1. Dated test restore: RTL-2026-014, 2026-11-10, PASSED, 2 h 50 m (verified by issuing a cert from the restored CA). Honest note: the first attempt (RTL-2026-013, 2026-11-04) failed and forced backup redesign DEC9 — both logged in the Restore Test Log. Root key outside Velero per the Gate-2-ratified design exception; custody/re-access evidence CER-2026-001 §7. Next test due 2027-05 (Tier 1, 6-monthly). | Y |
| Security: hardening applied, patch path set (FSD-RR), vuln posture acceptable, exceptions logged (FSD-SA) | SEC-01 hardening checklist completed for step-ca/portal/inventory images (Confluence: CertHub SEC-01 checklist, signed Elena Vasquez 2026-11-14). Trivy in pipeline; zero known criticals at submission (scan run #1841, 2026-11-19; one high in the portal base image, patch PR open, inside SEC-04’s 30-day window). Patch path: Flux/GitOps per SEC-04; smallstep advisories watched via supplier entry SUP-041. Exceptions log: no SEC-01 exceptions; the root-key backup departure is a Gate-2-ratified design exception, not a shortfall. | Y |
| Access: access model implemented; least privilege; JML handling confirmed | Okta SSO; role groups only — certhub-admin (Platform) + certhub-team-<n> ×8, mapped to owned namespaces/zones (a team can only request certs for what it owns). Admin restricted to Platform; break-glass provisioner password in the Platform vault under dual control (SEC-02). JML per SEC-02 confirmed with Okta joiner/leaver flow (leaver test: pilot-team leaver 2026-11-02, access gone same day — JSM ref in evidence page). Review cadence booked: privileged quarterly (first 2027-01), standard 6-monthly. | Y |
| Availability: SLO met or accepted; capacity & scaling understood; DR position recorded | Tier 1: 99.5% monthly, 24×7, measured on canary issuance + portal. Observed: Oct 99.9% (partial month), Nov-to-date 100% (Grafana /d/certhub-health, SLO panel). Capacity: ~0.6 vCPU/1.4 GiB, ~340 orders/day, ×10 headroom (HLD §7). DR: rebuild from Git + restore, RTO/RPO proven 2026-11-10 (2 h 50 m vs 4 wh; RPO minutes vs 24 h bar). Graceful-degradation property stated and true by design (HLD §2). Only 5 weeks of live history — noted for the Approver; the design and the tested DR are the evidence, the track record is short. | Y |
| Monitoring & alerting: monitoring live; thresholds set; test alert observed end-to-end | Full catalogue with thresholds and routing: Monitoring §1–2. All 212 inventoried certs export certhub_cert_expiry_seconds — the baseline’s “expiry-style dates always monitored” row is now met estate-wide, which was the point. Test alert observed end to end 2026-11-11: Opsgenie #48213, paged, acknowledged in 4 min (Monitoring §3, screenshots attached). | Y |
| Incident profile: service-level incident triggers & severities registered with the incident-management process | Profile per IM-02 (Sev1–4 triggers incl. the deliberate “cert <7 d, no renewal in flight = Sev2” trigger) — canonical copy runbook §4; registered with the service desk 2026-11-17: JSM CertHub service entry, IM-02 per-service annex, triage guide live, Owen Gallagher’s acceptance recorded (Monitoring §4). | Y |
| Supportability / handover: support model agreed; runbook & SOPs accepted by operators; knowledge transfer / cross-training done; team ready; continuity assured (not reliant on one person); any new/changed standing procedure the service forced (Gate 2 §4) written & adopted | Support model per baseline (desk 09:00–17:30, Rafi tier 1/2 with triage guide; Opsgenie rota for Sev1 OOH) — agreed at the 2026-11-17 operator review; runbook + SOPs formally accepted by Owen Gallagher and Rafi Osman. Continuity per baseline: primary Priya Chandra, deputy Jordan Blake; dated walk-throughs — Marcus Webb (interim) 2026-11-05, Jordan Blake 2026-11-12 (hands-on in dev incl. break-glass dry run); revocation rehearsal 2026-11-13 (live canary revoke; intermediate-compromise tabletop). All five Gate-2-§4 standing procedures (SOP-1…5) plus SOP-6 written during build and adopted 2026-11-17. Honest note: Jordan joined 2026-10-12; the walk-through bar is met, but he has not yet performed an intermediate ceremony — shadow drill scheduled Q1 2027 (runbook §8). | Y |
| Cost / licensing: licences in place; ongoing run-cost confirmed and owned | Supplier & Dependency Register: SUP-041 step-ca (Apache-2.0 — register entry is the licence evidence per applicability rule 3; exit path + June review date recorded per Gate 2 condition 4), SUP-042 Let’s Encrypt (deliberate no-SLA dependency), SUP-043 AWS KMS (~£60/yr), SUP-044 Sectigo (FIN-03 PO-2026-0412, £1.7k/yr, renewal 2027-09, owner Marcus). Cash run-cost £1.86k/yr on the Platform cost centre (Marcus). Steady-state operating effort (Gate 2 condition 1): est. 1.5–2 pd/month — breakdown at §1a(1). No personal accounts anywhere in the chain. | Y |
1a. Gate 2 conditions — position at acceptance
(Local convention, as at Gate 2: the template has no field for discharging gate conditions; recorded here so the Approver need not chase.)
- Steady-state operating effort stated (Dana, condition 1). Estimate 1.5–2 pd/month: patching/upgrades 0.5; alert handling + scan/posture triage 0.5; support & onboarding 0.25; portal upkeep 0.25; amortised periodic work (restore tests, access reviews, ceremony prep) 0.25. Basis: 5 weeks of live operation (actuals ≈ 1.6 pd/month excluding migration). Plus a temporary ~1 pd/month migration tail until 2026-12-18 — project tail, not steady state. Within the ~2 pd/month line; if reality exceeds it, it routes to the CTO with the next headcount round as directed.
- Build concentration: Marcus confirmed schedule + rota held at the 2026-09-25 checkpoint. The later two-week drift (header note) was evidence-driven, not compression of the acceptance work.
- Ownership resolved at acceptance: Service register entry updated 2026-11-19 — Service Owner: Priya Chandra; deputy: Jordan Blake (live from today, not retrospective). Product ownership (R6/Sam Reyes): declined for 2026 — Sam’s assessment is that a Tier 1 operational platform service needs an operational owner, and his slate is full until Q2 2027; he has offered quarterly roadmap input on the portal. Per the condition, Marcus Webb holds the product-ownership question by default; revisit at the June 2027 review. Recorded here as the decision this form was asked to carry.
- Standing risks transferred: R1→RSK-031 (owner Priya), R2→RSK-032 (Marcus), R6→RSK-033 (Marcus) in the Platform Risk Register, review dates set; SUP-041 carries the smallstep exit path.
- Migration reporting: 2 pilot teams live, legacy automation decommissioned (CHG-2231/2232); wildcards adopted 2026-10-28; six teams scheduled to 2026-12-18; standing item on the monthly ops review; June 2027 management-review line item created.
- FIN-03: completed on time (PO-2026-0412, 2026-09-25). No paid smallstep support taken; OPEX £1.86k/yr, far under the £10k line.
2. Outstanding remediation
Amended at sign-off (MW, 2026-11-27). No row records an unmet criterion — all nine §1 rows stand as evidenced. FSD-PRO §7 reserves this table for criteria “not yet met”, so carrying the acceptance conditions here is a local repurposing (noted to the findings): rows 1–3 are the build-consequence actions as submitted; rows 4–11 carry the conditions arising from the operator reviews (Owen Gallagher 2026-11-24; Rafi Osman 2026-11-24) and Sam Reyes’s product-ownership answer (2026-11-26). Every row is a condition of the §3 acceptance: standing item at the monthly ops review until closed; closure recorded against this record by the Management System Owner.
| # | Criterion | Action required | Owner | Target date |
|---|---|---|---|---|
| 1 | — (Monitoring, residual) | 4 of 31 scan-discovered certificates still unowned (all >90 d to expiry, alerting to #platform-alerts; on-call adopts any that go sub-14-day). Assign owners; zero unowned is the SOP-6 standing target. | Marcus Webb | 2026-12-04 |
| 2 | — (Gate 2 condition 5) | Six remaining teams migrated, legacy renewal automation decommissioned (per-team CH-01 changes). Estate must not stay split-brain past this date without a CTO decision. | Marcus Webb (schedule); team leads | 2026-12-18 |
| 3 | — (Supportability, depth) | Intermediate-ceremony shadow drill for the deputy (Jordan) — beyond the baseline’s walk-through bar, scheduled because the hardest procedure shouldn’t be single-person either. | Priya Chandra / Elena Vasquez | Q1 2027 |
| 4 | Access / Supportability (RO fix 1) | Desk access pack: read-only certhub-support inventory/portal group created and recorded in the access model; desk Grafana viewer confirmed on both CertHub dashboards; explicit runbook statement that tier 1/2 holds no kubectl/bastion/AWS access and no procedure step assumes otherwise. Tripwire (§3): if not landed by the date, a risk is raised against the Supportability row and the desk does not hold the queue solo. | Priya Chandra | 2026-12-04 |
| 5 | Supportability (RO fix 2) | Tier-1 lane marked in every runbook §5 procedure — what the desk does and checks, the exact stop line, the handoff route — on the §5.3 header pattern, or a per-section cross-link to the matching triage-guide entry. | Priya Chandra, with Rafi Osman | 2026-12-04 |
| 6 | Supportability (RO fix 3 + OG C3) | Runbook §7 escalation table gains hours per row, absence cover (incl. first-line cover for the CertHub queue when Rafi is absent — named cover or routing to the rota) and the mechanics of a desk-classified Sev2 reaching the Opsgenie rota; written into runbook and triage guide. | Owen Gallagher / Rafi Osman (runbook edit: Priya Chandra) | 2026-12-04 |
| 7 | Supportability / Availability (OG C1) | One-page CertHub service statement published to product teams (user guide child page, linked from the register): availability target and its status (objective, not guarantee), the outage-≠-expiry property, support hours, response targets by severity, out-of-hours position (Sev1 only), break-glass in a genuine emergency. Reviewed by Owen before publication; no further team migrates before it is up. | Priya Chandra, with Owen Gallagher | Before 2026-12-18 migrations |
| 8 | Availability / reporting (OG C2) | Standing monthly service summary to team leads riding the SOP-6 review output: SLO attainment (composition stated at first issue), Sev1/2 count with one-line closures, expiring/unowned-cert posture, migration state until complete. | Owen Gallagher (format); Priya Chandra (data) | First issue by 2026-12-05 |
| 9 | Supportability (RO fixes 4–6) | Canned comms lines for runbook §5.1/§5.2 on the §5.3 pattern; ticket taxonomy settled (a home for the auto-raised 14-day expiry tickets; a route for migration questions until close); triage guide brought under the runbook’s regime — dated, versioned, review-cycled, in scope of the next operator review. | Priya Chandra / Rafi Osman | 2026-12-18 |
| 10 | Cost & ownership (Gate 2 condition 3; SR memo) | Product ownership: Sam Reyes’s conditional yes (effective Q2 2027, five terms — memo of 2026-11-26) taken to Dana Okafor for ratification at the December ops review, terms 1 and 3 amending the Adoption Pack. Until terms 1–3 are in place, Marcus Webb holds product ownership by default; if not in place by end Q1 2027, the §1a(3) position stands (quarterly input only). | Marcus Webb (to Dana Okafor) | 2026-12 ops review; terms by end Q1 2027 |
| 11 | Supportability (baseline wording) | Owen’s amendment to the Supportability baseline row (customer-facing service statement + reporting to consuming teams) drafted for the June 2027 baseline re-ratification, so the next service doesn’t need an SDM memo to close the same hole. | Owen Gallagher | 2027-06 review |
3. Acceptance sign-off
| Field | Entry |
|---|---|
| Decision | Accepted into service — with the conditions below. All nine baseline criteria are met and evidenced (§1); none of the three reviews finds a criterion unmet — each accepts, with conditions that are post-acceptance actions carrying owners and dates. The process gives me two outcomes only; “Remediation required” would send back to delivery work this record shows done, and would put the 2026-12-18 migration at risk over gaps the reviewers themselves call non-blocking. So: Accepted, and the reviews’ conditions are carried as binding conditions of the acceptance (below; actions at §2). Since neither the process nor this form says what an acceptance signature commits — Gate 2 set the precedent of stating it — I am stating it: this acceptance places CertHub on the Platform Service Register as a live Tier 1 service under the Service Owner named below; commits the desk and the on-call rota to the registered support model and incident profile; accepts the £1.86k/yr cash run-cost and the est. 1.5–2 pd/month steady-state operating effort onto the Platform team, inside Dana’s Gate 2 condition 1 line; and makes the §2 conditions mine to see closed. Gate 2’s at-acceptance conditions are discharged as recorded at §1a, save product ownership, which moves per §2 row 10. From today CertHub is BAU: changes via CH-01, incidents via IM-02. |
| Approver | Marcus Webb, Platform team manager — per Adoption Pack §2 (within Platform budget, Platform-run service; builder rule holds: Priya Chandra built and does not approve; operator-side review by Owen Gallagher and Rafi Osman informed this decision). |
| Conditions | Every §2 row as amended at sign-off, each with owner and target date; tracked as a standing item at the monthly ops review until closed, closure recorded on this record. Three are load-bearing: (1) the desk access pack and tier-1 lanes (§2 rows 4–5) land by 2026-12-04, or a risk is raised against the Supportability row and the desk continues only with a Platform engineer on tap — the desk is not asked to hold the CertHub queue solo before they land (per Rafi Osman’s written acceptance); (2) the service statement (§2 row 7) is published, Owen-reviewed, before any further team migrates; (3) the product-ownership terms route to Dana Okafor per §2 row 10 — her Gate 2 condition 3 is otherwise discharged. |
| Date | 2026-11-27 |
| Service register entry | Platform Service Register, confirmed at acceptance: CertHub — certificate management service · Service Owner: Priya Chandra (deputy: Jordan Blake) · Tier 1 · Status: Live — accepted 2026-11-27, §2 conditions open. The 2026-11-19 register update (§1a(3)) is ratified as the live entry; the Service Owner is named by me at sign-off. |
(The template closes at the Date row and has no field naming the live Service Owner or the register entry the process’s lifecycle ends on — “live service register entry + owner”. The row above is a local addition so this record carries the register line; noted to the findings — MW.)