ddp-offboard

Files (1)

• SKILL.md

SKILL.md (first lines)

Use this skill when a dealership takes back control of its deployment from an IT provider it hired (to run it with its own staff or a different provider), or retires the deployment. The dealership owns every account involved; this checklist helps it rotate what the provider knew and remove what the provider could reach. Read [discovery](../../docs/discovery.md), [deployment](../../docs/deployment.md), [accounts](../../docs/accounts.md), [backups](../../docs/backups.md), [retention](../../docs/retention.md), and the [runbook](../../docs/runbook.md).

1. Ask the dealership's authorized person to confirm the date, whether this is taking back control or decommissioning, who runs the system afterward, any required export, the retention period, recovery obligations, and where the registry, source, database, backups, logs, and rendered outputs should be kept.
2. Inventory declared systems, users, roles, schedules, integrations, `platform_ops` and other communications recipients, domains, the Cloudflare account, repositories, credentials, backup manifests, image digests, recovery keys, and open incidents from the registry and documented inspection commands. Mark every credential and account the provider held or could read.
3. To take back control, with explicit direction from the dealership: make and verify a fresh backup, and confirm the person who will run the system can sign in through the dealership's own Cloudflare Access policy and follow the [runbook](../../docs/runbook.md). Then the dealership rotates the Cloudflare tunnel token, the backup storage keys, the backup encryption key pair (a reviewed change to `deploy.backup.recipient` plus the host's `BACKUP_AGE_IDENTITY`; keep old private keys offline until their archives expire), the GHCR package token, component database passwords (`ddp provision <component>`) and integration secrets, and updates `platform_ops` recipients. It limits the SSH route's Cloudflare Access policy to its own administrators and removes the provider's server accounts and SSH keys, portal accounts, including operator accounts, with `ddp users disable` before the dealership bootstraps its own operator (see [Remove access](../../docs/accounts.md#remove-access)), GitHub organization and repository access, and storage access.
4. To decommission, with explicit direction from the dealership: stop schedules and communications (`ddp jobs pause`), complete and verify the chosen final backup and export, confirm the dealership can use what it keeps, then revoke SSH, Cloudflare, portal, repository, integration, storage, and database access.
5. Check retention and deletion decisions against the dealership's own requirements and record who approved each action, what remains retained, where, and until when.
6. Return the inventory, evidence, unresolved items, and approval record. A person performs destructive deletion and final account closure; this skill does not invent automation or perform irreversible cleanup.

The repository provides no offboarding automation. Do not claim access removal, credential rotation, or deletion until a person has verified it.

From Profreshor/Dealership-Data-Platform, MIT.

More from Profreshor/Dealership-Data-Platform