OpenCyber AcademyLesson map
Lesson 33 published. Map, example, EX097.
flowchart TD
N0["Learning outcomes"]
N1["33.1 Executable stops"]
N2["33.2 Rollback"]
N3["33.3 Tabletop"]
N4["33.2b Communication templates"]
N5["33.3b Resume authority"]
N6["33.1b Secondary contacts"]
N7["Practice note"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX097"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["33.1 Executable stops"]
N2["33.2 Rollback"]
N3["33.3 Tabletop"]
N4["33.2b Communication templates"]
N5["33.3b Resume authority"]
N6["33.1b Secondary contacts"]
N7["Practice note"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX097"]
[Learning outcomes]
|
v
[33.1 Executable stops]
|
v
[33.2 Rollback]
|
v
[33.3 Tabletop]
|
v
[33.2b Communication templates]
|
v
[33.3b Resume authority]
|
v
[33.1b Secondary contacts]
|
v
[Practice note]
|
v
[Worked example] --> [Exercise EX097]
Learning outcomes
You will (1) write stop conditions as executable checks; (2) plan rollback of tool changes mid-engagement; (3) run a tabletop on a deny-list miss.
33.1 Executable stops
Stop conditions are code: deny-list, latency canary, client kill-switch file. Humans also call stop; software must not disagree with a human stop.
Kill-switch files, deny-lists and canaries must honour the same halt. Sam's stop API flips a single flag that every method polls within the ROE time bound. Poll intervals are asserted in a unit test tied to the ROE time bound. Lengthening the poll past that bound without a matching ROE edit fails CI, which is what stopped a pull request that tried to "save CPU" by polling every two minutes during a thirty-second kill-switch promise.
33.2 Rollback
Pin releases; keep previous TrackScope binary signed. If a new build mis-evaluates scope, roll back within minutes, not "after the sprint".
Signed previous binaries make minutes-scale rollback real. Waiting for a sprint after a bad scope evaluation is unacceptable. Sam keeps the last known-good on the jumphost with its signature verified at start. Signature verification failure at start pages before any method launches. Methods refuse to start while the signature check is red, and FindingsDesk rejects writes from that jumphost until the signature clears, so a rolled-back binary cannot leave findings that claim they came from a build the team no longer trusts.
33.3 Tabletop
Walk the 11:10 timeline: who is called, what is said, what is logged, when resume is allowed. Update the runbook where the tabletop stuck.
Synthetic case — Riverstone Transit. Tabletop found the kill-switch file path undocumented; runbook v1.4 fixed it before the next window.
Walking who-calls-whom finds missing paths cheaply. Undocumented kill-switch locations are typical sticky notes. Updating the runbook before the next window is the acceptance test for the tabletop. Sam schedules one tabletop per term and records attendance. Schedulers will not name a lead for a client window unless that person appears on the current term's attendance list, which is how the undocumented kill-switch path found in the tabletop became required reading before the next Riverstone window.
33.4 Errors and limits
Resilience theatre is a binder nobody opens. Drill once per term.
Binders nobody opens are worse than no binder because they create false assurance. Sam marks the term incomplete in the training record until the drill measure is filed, and he refuses to staff a lead who has not joined a drill in the current term. Schedulers read those training records directly, so a substitute can prove readiness without asking around the room on the morning of a window. A drill that was planned but not run counts as missed.
33.2b Communication templates
Pre-write the SMS/email for stop, for resume, and for rollback. Under stress people improvise and omit the ROE version or the next checkpoint time. Templates live in the runbook and are tested in the tabletop.
Testing them in the tabletop finds missing fields. Sam stores templates beside the runbook with the same review path as code. Template review uses the same CODEOWNERS path as TrackScope safety code. Each template leaves blanks only for the time, the reason and the sender, so everything else is already correct when the stop is called. Resume messages also name the role that granted the resume.
33.3b Resume authority
Who may resume after a stop? Name the role in the ROE. TrackScope should require a resume token tied to that role and ScopeVersion, not a Boolean flip anyone on the jumphost can toggle.
A Boolean on the jumphost is not authorization. Sam's token expires quickly so a leftover resume cannot outlive the decision. Expired resume tokens log a deny with reason resume-expired. PulseMap charts those beside ordinary deny-list hits each week; a spike after a tabletop usually means someone tried to reuse a leftover token instead of requesting a fresh resume.
33.1b Secondary contacts
Stop conditions that page only one person fail when that person is offline. Maintain primary and secondary contacts with acknowledged handoff, tested in the tabletop.
Single points of human failure break stop conditions as surely as single points of code failure. Acknowledged handoff is tested, not assumed. Sam's tabletop always pages the secondary once on purpose. An unanswered secondary page fails the tabletop even if the primary acted, and it opens a staffing ticket before the tabletop can close — Riverstone once had a week where the secondary was on leave and nobody had been named.
Practice note
After every real stop, run a five-minute hotwash: what fired, what lagged, what confused the client. File at least one runbook edit when possible. Stops that produce no documentation updates will recur with the same confusion, and the timeline will look identical to the chapter's 11:10 example for the wrong reasons.
33.4b Proving the stop button works
Before each engagement, the lead presses the stop control in the synthetic range and checks that every running method halts within the time written in the ROE. The result, with the measured time, is attached to the engagement record; an untested stop is treated as no stop.
Measured halt times attached to the engagement record make the ROE promise checkable. Untested stops equal no stop in Sam's readiness review. He fails kickoff if the last synthetic stop measure is older than seven days or slower than the written bound.
Exercises
- EX097 — Kill switch. Design a human kill switch TrackScope honors in ≤30s. Rubric: 3 = mechanism + check interval + fail closed; 2 = idea; 1 = vague; 0 = none.
- EX098 — Rollback. List three preconditions to roll back mid-engagement. Rubric: 3 = prior binary, policy pin, notify client; 2 = two; 1 = one; 0 = none.
- EX099 — Tabletop ask. Write one inject for the tabletop. Rubric: 3 = specific inject; 2 = vague; 1 = none; 0 = unsafe inject.
Synthesis
Stops you can run, rollbacks you can do, tabletops that update runbooks.
Continue studying — chapter 33 of 50
← Chapter 32 (draft) · Course chapter index · Chapter 34 (draft) →