Chapter 26 — Cryptography and trust services: operational handoff
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 What handoff means"]
N2["26.2 Runbooks and ownership"]
N3["26.3 Rehearsal"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 What handoff means"]
N2["26.2 Runbooks and ownership"]
N3["26.3 Rehearsal"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 What handoff means]
|
v
[26.2 Runbooks and ownership]
|
v
[26.3 Rehearsal]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) prepare a service for handoff to operations; (2) write runbooks and ownership records; (3) run a handoff rehearsal.
26.1 What handoff means
When Rosa's placement project, automated renewal and the planner, is ready, it must pass to the council's operations team, who will run it after she leaves. Handoff means operations can run, monitor, troubleshoot and change the service without her. Owen reminds her that many council systems became fragile because their builders left without handing over knowledge, leaving undocumented scripts nobody dared touch. Rosa lists everything she does by habit, which reveals tasks she had never written down, such as checking the planner's disk space weekly. She also lists open problems honestly, so operations do not inherit hidden surprises. The handoff plan sets a date after which she answers questions only by improving documentation.
26.2 Runbooks and ownership
Rosa writes runbooks for routine tasks and failures: reading the daily plan, handling an escalation, renewing manually when ACME fails, restoring the planner after a server rebuild and rotating the ACME account key. Each runbook lists prerequisites, steps, verification and rollback. She updates the inventory to name the operations team as owner and records where credentials live in the secret store, without including the credentials themselves. Runbooks live in the operations wiki beside the inventory, with a review date and named maintainer, so they do not quietly go stale once Rosa leaves the council.
26.3 Rehearsal
Rosa runs a rehearsal: an operations colleague, with no help from her, handles a simulated failed renewal using only the runbook. The colleague gets stuck because the runbook assumes knowledge of where logs are stored. Rosa adds the missing step and repeats the rehearsal with another colleague, who succeeds. Handoff is signed off by the operations lead. Rosa learns that runbooks are only proven when someone else uses them. After sign-off, Rosa schedules a check-in one month later to collect questions, which become further runbook improvements. The operations lead adds the rehearsal to their yearly exercise calendar.
Worked example
Rosa hands off renewal automation with runbooks, ownership records and a rehearsal that exposes a missing log-location step.
Synthetic case. The handoff is invented.
Errors and limits
Runbooks written by experts often skip steps they find obvious. Credentials must transfer through the secret store, not documents.
Exercises
- EX076 — Handoff meaning. What does handoff mean in this chapter? Rubric: 3 = operations can run, monitor, troubleshoot and change without the builder;; 2 = full;; 1 = partial;; 0 = none.
- EX077 — Rehearsal finding. What did the first rehearsal reveal? Rubric: 3 = runbook assumed knowledge of log location;; 2 = gap;; 1 = vague;; 0 = none.
- EX078 — Credentials. How are credentials handed over? Rubric: 3 = via the secret store with location recorded, never in documents;; 2 = store;; 1 = docs;; 0 = none.
Synthesis
A handoff is complete when others, using only runbooks and records, can operate the service.
Continue studying — chapter 26 of 30
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →