# Execution playbook: all phases (52 weeks)

> A phase is complete only when every acceptance test passes and every gate sign-off is filed.
> Record evidence in the site's tracker, export the JSON, and archive it with the commissioning file.

## Phase 1: Foundation (Months 1–3, weeks 1–13)

**Goal:** Permitted microgrid, essential IT on A/B UPS, separate sovereign enclave and default-deny network, each proven by test rather than by assumption.

### WP 1.1: Site, permits & interconnection (weeks 1–4, owner: Lead System Architect + PE)
- [ ] AHJ pre-application meeting; engage licensed PE (electrical + mechanical)
- [ ] Utility interconnection application (IEEE 1547), single-line diagram submitted
- [ ] Flood elevation survey; set equipment floor above BFE + freeboard (ASCE 24)
- [ ] Structural basis: ICC 500 / FEMA P-361 for the equipment room

### WP 1.2: Microgrid: PV, BESS, ATS (weeks 3–12, owner: Microgrid Engineering Lead)
- [ ] Install UL 9540 BESS with NFPA 855 spacing and off-gas detection
- [ ] PV strings and UL 1741 inverters; rapid shutdown per NEC 690.12
- [ ] ATS + generator auto-start; islanding test with utility witness
- [ ] Wire inverter SOC dry contact to the (future) mining coil-chain terminal block

### WP 1.3: Essential IT (T1) & enclave (weeks 6–11, owner: Lead System Architect)
- [ ] Rack, A/B PDUs, two SRT3000 on separate 208 V/20 A circuits
- [ ] R750 Proxmox node A + QDevice; GPU node B joined later as deferrable
- [ ] R650 enclave stand-alone on its own switch + data diode (never clustered)
- [ ] TrueNAS pools: NVMe mirrors and 2× 6-wide RAID-Z2; offsite replication target

### WP 1.4: Network & zero-trust (weeks 6–13, owner: Lead System Architect)
- [ ] VLANs 10/30/40/50 on core; OOB switch physically separate
- [ ] pfSense rule matrix loaded (firewall-matrix.csv), default deny inter-VLAN
- [ ] Proxmox SDN: one VNet + firewall group per tenant
- [ ] Bastion with FIDO2-only SSH; IPMI reachable only from bastion

### Acceptance tests
| ID | Test | Method | Pass criterion | Evidence |
| --- | --- | --- | --- | --- |
| p1-ups | Single-UPS carry test | Open Feed A breaker at full T1 load; repeat for Feed B | No device reboots; each UPS ≤ 80 % load; runtime ≥ design target |   |
| p1-ats | Islanding / ATS transfer | Utility-witnessed loss-of-mains test | T1 uninterrupted; anti-islanding trips per IEEE 1547; generator starts and transfers |   |
| p1-quorum | Cluster quorum test | Hard power-off GPU node B | Cluster stays quorate (2 of 3 votes with QDevice); VMs on node A unaffected |   |
| p1-seg | Segmentation test | Run segmentation-test.sh from a probe in each VLAN | Every result matches firewall-matrix.csv; zero unexpected open ports |   |
| p1-diode | Data-diode one-way test | Send traffic toward enclave through the diode; capture on enclave side with a tap | Zero packets reach the enclave; outbound signed-hash export succeeds |   |
| p1-zfs | Storage resilience | Pull one disk per vdev; resilver; scrub; restore a VM from offsite replica | Resilver completes with 0 errors; restored VM boots and checksums match |   |

### Gate 1: sign-offs
- [ ] PE sign-off on as-built drawings
- [ ] AHJ final electrical inspection
- [ ] Utility permission to operate (PTO)
- [ ] Phase 1 test evidence filed (screenshots, logs, signed sheets)

### Deliverables
- `phases/phase1/firewall-matrix.csv`: Firewall rule matrix (source of truth for pfSense + tests)
- `phases/phase1/segmentation-test.sh`: Segmentation test script (nmap, read-only)
- `phases/phase1/proxmox-sdn.cfg`: Proxmox SDN zone/VNet example
- `phases/phase1/zfs-pools.sh`: ZFS pool layout (dry-run by default)

## Phase 2: Thermal integration (Months 4–6, weeks 14–26)

**Goal:** The hydro mining fleet runs as a fail-safe, curtailable load, and the heat goes to a real loop. Every interlock has been tripped on purpose and timed.

### WP 2.1: Mining bus & hydro fleet (weeks 14–19, owner: Microgrid Engineering Lead)
- [ ] 208 V 60 A 3P sub-panel; energize-to-run contactor sized for miner inrush
- [ ] Coil chain wired per coil-chain-wiring.md (SOC → thermal switch → ESP32 relay → coil)
- [ ] Install hydro units; set firmware power limit to fit the 11 kW budget
- [ ] Pin miner API to EMS host only; Stratum V2 to pinned pool endpoints

### WP 2.2: Primary & secondary plumbing (weeks 14–22, owner: Mechanical contractor + PE)
- [ ] Primary loop: miners → air separator → PHE → pumps (MAGNA3 ×2) → expansion tank
- [ ] Belimo 3-way valve (fail to dry cooler) + dry cooler sized for 100 % rejection
- [ ] Hydrostatic test at 1.5× working pressure, 2 h, no drop
- [ ] Flush, then fill with inhibited PG (30 % southern / 35 % northern); refractometer log

### WP 2.3: Controls & sensing (weeks 18–24, owner: Lead System Architect)
- [ ] ESP32 nodes flashed with thermal-node-01.yaml; MQTT TLS certs per device
- [ ] Home Assistant automations loaded; alert routes tested
- [ ] Leak rope + RDHx isolation valves; drip tray
- [ ] Flow-meter K-factor calibrated by timed bucket test

### WP 2.4: Commissioning (weeks 23–26, owner: PE + commissioning agent)
- [ ] Execute commissioning-checklist.md end to end
- [ ] 72-hour heat run at full fleet power with metered heat
- [ ] Record ERF baseline and loop ΔT/flow trends
- [ ] Insurer walkthrough of BESS, mining bus and leak controls

### Acceptance tests
| ID | Test | Method | Pass criterion | Evidence |
| --- | --- | --- | --- | --- |
| p2-coil | Coil-chain drop time | Open each link (SOC contact, thermal switch, ESP32 relay) with a scope on the contactor | Mining bus de-energizes ≤ 50 ms for every link |   |
| p2-temp | Over-temperature trip | Supply probe in a 66 °C bath | Interlock fault → relay off within one 2 s update |   |
| p2-flow | Low-flow trip | Close primary isolation valve | Shed within ≤ 12 s (10 s delay + update) |   |
| p2-sensor | Sensor-fault trip | Unplug DS18B20 probe | NaN detected → shed; re-enable refused until fixed |   |
| p2-mqtt | Supervisor-loss trip | Stop MQTT broker | Node sheds mining on disconnect |   |
| p2-boot | Reboot safety | Power-cycle ESP32 with mining enabled | Boots with mining OFF; no auto-restart |   |
| p2-valve | Valve fail position | Remove actuator power | Valve drives to dry cooler; loop temperature stays below warning |   |
| p2-leak | Leak response | Wet the leak rope | RDHx valves close; alert received within 30 s |   |
| p2-heat | 72-hour heat run | Full fleet at power limit; log flow, ΔT, kW | No trips; metered kW_th within ±5 % of electrical × capture estimate |   |

### Gate 2: sign-offs
- [ ] Mechanical inspection + pressure-test certificate
- [ ] Signed commissioning report (all Phase 2 tests)
- [ ] Insurer acceptance
- [ ] Operations runbook + on-call rota live

### Deliverables
- `phases/phase2/coil-chain-wiring.md`: Coil-chain wiring schedule
- `phases/phase2/plumbing-bom.csv`: Primary/secondary plumbing BOM
- `phases/phase2/commissioning-checklist.md`: Commissioning checklist (signable)
- `config/thermal-node-01.yaml`: ESPHome node (validated)
- `config/ha-automations.yaml`: Home Assistant automations

## Phase 3: Scaling & cooperative (Months 7–12, weeks 27–52)

**Goal:** Heat sold through a meter, community tenants onboarded safely, a treasury that needs three humans to move funds, and a monthly public report.

### WP 3.1: Municipal hydronic connection (weeks 27–44, owner: Municipal Infrastructure Director + PE)
- [ ] Heat supply agreement (heat-supply-term-sheet.md) through counsel
- [ ] Pre-insulated buried pipe; backflow prevention; heat meter with calibration certificate
- [ ] Potable DHW: double-wall vented HX, ≥ 140 °F storage, ASHRAE 188 water-management plan
- [ ] Hand-over test with municipal facilities staff

### WP 3.2: Community compute onboarding (weeks 30–40, owner: Co-op Board Member + Lead Architect)
- [ ] Publish acceptable-use policy (community-compute-aup.md)
- [ ] Eligibility check (school / emergency service / registered non-profit)
- [ ] Tenant template: VNet, firewall group, quotas, backups, offboarding wipe
- [ ] Pilot with 3 organisations, then a third-party isolation pen test

### WP 3.3: Treasury & revenue routing (weeks 34–48, owner: Independent Auditor + all keyholders)
- [ ] Public-funds counsel opinion before any coin is held
- [ ] 3-of-5 key ceremony on hardware signers; geographically split backups
- [ ] Pool payouts → watch-only multisig; conversion PSBTs prepared automatically, signed by 3 humans
- [ ] Recovery drill on signet, including the time-locked path

### WP 3.4: Reporting & audit (weeks 44–52, owner: Independent Auditor)
- [ ] Monthly ERF + heat-delivered report (erf-report-template.md)
- [ ] Community compute hours and tenant count
- [ ] Treasury statement reconciled to on-chain data
- [ ] Annual independent review

### Acceptance tests
| ID | Test | Method | Pass criterion | Evidence |
| --- | --- | --- | --- | --- |
| p3-meter | Heat-meter reconciliation | Compare billing meter vs ESPHome-derived kW over 7 days | Agreement within ±5 %; calibration certificate on file |   |
| p3-legionella | Legionella sampling | Lab samples at storage and the farthest fixture | Below action limits in the site water-management plan |   |
| p3-pentest | Tenant isolation pen test | Independent tester inside one tenant VNet | No access to other tenants, management, IoT or mining |   |
| p3-keys | Treasury recovery drill | Signet: spend with 3 of 5; then the time-locked recovery path | Both paths succeed; no single person can move funds |   |
| p3-report | First public report | Publish month-1 ERF, heat delivered, uptime, community hours | Figures trace to meter exports and logs |   |

### Gate 3: sign-offs
- [ ] Counsel opinion: heat sale + public-funds treatment
- [ ] Signed heat supply agreement
- [ ] Pen-test report with no open critical findings
- [ ] Auditor sign-off on first treasury statement

### Deliverables
- `phases/phase3/heat-supply-term-sheet.md`: Heat supply term-sheet template
- `phases/phase3/community-compute-aup.md`: Community compute acceptable-use policy
- `phases/phase3/treasury-runbook.md`: Treasury multisig runbook
- `phases/phase3/erf-report-template.md`: Monthly ERF report template