{"id":"vps-change-plan","filename":"vps-change-plan.yaml","schema":"change-plan","document":{"version":"1.0","change_id":"CHANGE-DEMO-VPS-001","authorization_id":"AUTH-DEMO-2026-001","client_id":"client-demo","target":"203.0.113.10","environment":"production","change_level":"minor","objective":"Plan a key-only SSH and default-deny host-firewall baseline without locking out administration or interrupting HTTPS.","profile":"LAKA-VPS-WEB@1.0.0","risk":{"magnitude":4,"blast_radius":["demo-vps-01","production-website","administrative-access"],"lockout_risk":"high","data_loss_risk":"low","reversibility":"configuration backup plus provider-console restoration","dependencies":["provider-console","existing-admin-key","reverse-proxy","provider-firewall"]},"preconditions":{"authorization_current":true,"ownership_proof_verified":true,"backup_verified":true,"restore_evidence_current":true,"rollback_verified":true,"console_confirmed":true,"maintenance_window_confirmed":false,"kill_switch_configured":true,"health_baseline_captured":true},"canary":{"target":"demo-vps-01","required":true,"success_criteria":["second key-based administrative session succeeds","HTTPS health check remains healthy","only approved public listeners remain reachable"]},"steps":[{"step_id":"STEP-001","action":"Capture effective SSH, firewall, listeners, services, and configuration backups.","tool":"native-local-audit","expected_change":"none","validation":["evidence-hash-recorded","backup-files-readable"],"failure_action":"stop"},{"step_id":"STEP-002","action":"Create and validate the proposed Ansible diff in check mode.","tool":"ansible-check","expected_change":"plan-only SSH and firewall diff","validation":["syntax-valid","inventory-bound","no-unexpected-task","approved-port-set"],"failure_action":"stop"},{"step_id":"STEP-003","action":"Apply the approved role serially after separate approval.","tool":"ansible-apply","expected_change":"key-only SSH and default-deny firewall with HTTPS and administrative access preserved","validation":["new-key-session","ssh-effective-config","https-health","listener-diff","firewall-diff"],"failure_action":"rollback-change"}],"health_checks":["provider console remains available","new SSH session succeeds before old session closes","HTTPS returns the expected client hostname and health response","application and database services remain healthy","no unexpected public listeners appear"],"rollback":{"trigger_conditions":["new administrative SSH session fails","HTTPS health check fails","expected service does not start","firewall diff exceeds approved scope"],"method":["use retained session or provider console","restore SSH configuration backup","restore prior firewall rules","validate configuration before service reload"],"owner":"platform-security-owner","maximum_decision_time":"2m","verification":["administrative access restored","HTTPS health restored","prior effective SSH and firewall state confirmed"]},"evidence":{"before":["effective-sshd-config","firewall-rules","listeners","service-health","config-backup-hashes"],"during":["ansible-task-events","policy-decisions","operator-events"],"after":["effective-sshd-config","firewall-rules","listeners","health-checks","rollback-readiness"],"destination":"evidence://client-demo/changes/CHANGE-DEMO-VPS-001","integrity":"sha256-plus-signed-manifest"},"status":"planned"},"yaml":"version: \"1.0\"\nchange_id: CHANGE-DEMO-VPS-001\nauthorization_id: AUTH-DEMO-2026-001\nclient_id: client-demo\ntarget: 203.0.113.10\nenvironment: production\nchange_level: minor\nobjective: Plan a key-only SSH and default-deny host-firewall baseline without locking out administration or interrupting HTTPS.\nprofile: LAKA-VPS-WEB@1.0.0\nrisk:\n  magnitude: 4\n  blast_radius: [demo-vps-01, production-website, administrative-access]\n  lockout_risk: high\n  data_loss_risk: low\n  reversibility: configuration backup plus provider-console restoration\n  dependencies: [provider-console, existing-admin-key, reverse-proxy, provider-firewall]\npreconditions:\n  authorization_current: true\n  ownership_proof_verified: true\n  backup_verified: true\n  restore_evidence_current: true\n  rollback_verified: true\n  console_confirmed: true\n  maintenance_window_confirmed: false\n  kill_switch_configured: true\n  health_baseline_captured: true\ncanary:\n  target: demo-vps-01\n  required: true\n  success_criteria:\n    - second key-based administrative session succeeds\n    - HTTPS health check remains healthy\n    - only approved public listeners remain reachable\nsteps:\n  - step_id: STEP-001\n    action: Capture effective SSH, firewall, listeners, services, and configuration backups.\n    tool: native-local-audit\n    expected_change: none\n    validation: [evidence-hash-recorded, backup-files-readable]\n    failure_action: stop\n  - step_id: STEP-002\n    action: Create and validate the proposed Ansible diff in check mode.\n    tool: ansible-check\n    expected_change: plan-only SSH and firewall diff\n    validation: [syntax-valid, inventory-bound, no-unexpected-task, approved-port-set]\n    failure_action: stop\n  - step_id: STEP-003\n    action: Apply the approved role serially after separate approval.\n    tool: ansible-apply\n    expected_change: key-only SSH and default-deny firewall with HTTPS and administrative access preserved\n    validation: [new-key-session, ssh-effective-config, https-health, listener-diff, firewall-diff]\n    failure_action: rollback-change\nhealth_checks:\n  - provider console remains available\n  - new SSH session succeeds before old session closes\n  - HTTPS returns the expected client hostname and health response\n  - application and database services remain healthy\n  - no unexpected public listeners appear\nrollback:\n  trigger_conditions:\n    - new administrative SSH session fails\n    - HTTPS health check fails\n    - expected service does not start\n    - firewall diff exceeds approved scope\n  method:\n    - use retained session or provider console\n    - restore SSH configuration backup\n    - restore prior firewall rules\n    - validate configuration before service reload\n  owner: platform-security-owner\n  maximum_decision_time: 2m\n  verification:\n    - administrative access restored\n    - HTTPS health restored\n    - prior effective SSH and firewall state confirmed\nevidence:\n  before: [effective-sshd-config, firewall-rules, listeners, service-health, config-backup-hashes]\n  during: [ansible-task-events, policy-decisions, operator-events]\n  after: [effective-sshd-config, firewall-rules, listeners, health-checks, rollback-readiness]\n  destination: evidence://client-demo/changes/CHANGE-DEMO-VPS-001\n  integrity: sha256-plus-signed-manifest\nstatus: planned\n"}