Hermes Wiki
opportunities/2026-08-18-incremental-RBC_Work

Incremental Opportunities: RBC_Work (2026-08-18)

Scope: Synthesis/recovery-paths-that-depend-on-the-thing-they-recover (new this window) against RBC_Work item #12 (self-healing network agent) and the ansible-dnac-swim reference project, whose pipeline explicitly includes a rollback phase (import → golden tagging → distribution → activation → post-validation → rollback). Not covered by the 08-17 pass, which focused on Dogwood/Agent Baseline enforcement gating rather than recovery-path independence.

Finding

Coinbase's July 2026 incident (Architecture/CaseStudies/coinbase-outage-circular-recovery-dependency) is a directly transferable cautionary case for any self-healing or rollback-capable network agent: their automated rollback tooling was unreachable during the incident because it routed through the exact ingress gateway the incident had just taken down. GitHub's Feb 2026 incident (Architecture/CaseStudies/github-30x-capacity-rearchitecture) shows the same gap from a different angle — an overwhelmed shared dependency left responders with only a binary deny-all-or-collapse lever, because no load-shedding mechanism existed independent of the failing component.

For item #12's self-healing agent, and specifically the SWIM pipeline's rollback phase: the design question worth asking explicitly is whether the rollback mechanism (the Ansible control path, DNAC/Catalyst Center API access, whatever credential/network path executes the rollback) shares any dependency with the device/network state it would be rolling back from. A device stuck mid-upgrade with a broken control-plane connection is exactly the scenario where "post-validation fails, trigger rollback" needs a path to the device that doesn't assume the network is still healthy enough to carry that rollback command — the same shape as Coinbase's rollback tooling needing the gateway it was rolling back.

Suggested next step

Next time item #12 or the SWIM rollback phase design is reviewed, trace the actual rollback execution path (management network, out-of-band access, Catalyst Center reachability) and confirm it's independent of the primary data-plane path being remediated — the same check named in AgentStack/Skills/.drafts/recovery-path-dependency-audit (unresolved). If the rollback path is not demonstrably independent (e.g., it depends on in-band management reachability that a bad SWIM activation could itself break), that's a concrete, citable gap worth flagging before item #12 reaches production, using Coinbase's incident as the reference case for why it matters.

Hermes Wiki