Skip to content

Acquia Demo-Day Risk Register

Author: [email protected] | Date: 2026-04-25 (T-28h) | Demo: Acquia HQ Companion: RUNBOOK.md, PREFLIGHT-CHECKLIST.md, BACKUP-SCREENSHOTS-PLAN.md

L/M/H likelihood, low/med/high blast. "Recovery" = failure on stage.

R1 — Drupal LSP fatal; drush dies on bootstrap

  • Break: api_normalization + cedar_policy interfaces extend ContentEntityInterface while classes extend ConfigEntityBase. PHP refuses to compile. See memory/project_drupal_lsp_blocker.md.
  • L: M | Blast: high (no drush = no demo)
  • Detection: drush status exits non-zero; dblog shows Declaration of ... must be compatible.
  • Mitigation: Confirm upstream MRs landed in api_normalization + cedar_policy repos. Verify with composer show. Disable cedar_policy via core.extension if MR not merged (it's Tier-3, OUT in v2). Keep DB snapshot at db/snapshots/preflight-2026-04-24.sql.gz.
  • Recovery: Switch to backup screenshots tab. Narrate over static images. Do NOT hot-fix on stage.

R2 — ContractPlane /authorize returns 5xx

  • Break: ECA policy-gate call 500s; demo dead-ends before audit row.
  • L: M | Blast: high
  • Detection: Network tab 500; dblog PolicyGateException.
  • Mitigation: Pre-seed .agents/proposed-acquia/fixtures/contractplane_authorize.json. Set contractplane.settings:fixture_mode = true on stage; verify with drush cget.
  • Recovery: drush cset contractplane.settings fixture_mode true -y && drush cr (~8s). Else backup screenshots.

R3 — Acquia Cloud API auth fails (BLUEFLY_GATEWAY_TOKEN expired)

  • Break: Expired-token pattern from prior session. acquia_source 401s. No content flows.
  • L: M | Blast: high
  • Detection: curl -H "Authorization: Bearer $BLUEFLY_GATEWAY_TOKEN" https://cloud.acquia.com/api/applications → 401.
  • Mitigation: Refresh token via 1Password 4h before flight: op item get "Acquia Cloud API" --field credential --reveal. Re-run .ddev/web-entrypoint.d/10-1password-secrets.sh. TTL > 24h.
  • Recovery: drush cset acquia_source.settings fixture_mode true. Fixture: .agents/proposed-acquia/fixtures/acquia_inbox.json.

R4 — composer install on stage wipes node_modules; React bundle gone

  • Break: Deploy script clears theme node_modules and possibly dist/. Studio-UI panel renders blank.
  • L: M | Blast: med
  • Detection: /contextcontrol/studio blank, console: Failed to load module script vendors.js.
  • Mitigation: Build artifacts pre-flight: npm ci && npm run build. Commit dist/ to demo-artifacts branch. No re-deploy on demo day.
  • Recovery: git checkout demo-artifacts -- dist/ && drush cr (~15s). Refresh.

R5 — Acquia office network blocks api.copaw.us

  • Break: Guest WiFi blocks outbound. MCP gateway, ContractPlane, CC memory all on *.copaw.us.
  • L: M | Blast: high
  • Detection: curl -v https://api.copaw.us/v1/health hangs.
  • Mitigation: 5G hotspot. Pre-test on hotspot. Email host 24h ahead: allow-list *.copaw.us, *.contextcontrol.ai. Pack Ethernet adapter.
  • Recovery: Tether mid-demo ("switching networks for the live API call"). 30s pause is fine; an opaque hang is not.

R6 — vendors.js fails to load React externals

  • Break: Vite externalizes react/react-dom. If esm.sh/react@18 shim doesn't load first, mount throws Cannot read properties of undefined (reading 'createElement').
  • L: L | Blast: med
  • Detection: Console error; React mount div empty.
  • Mitigation: Verify contextcontrol_theme.libraries.yml declares react-shim as dep of studio-ui. Hard-refresh incognito 1h pre-demo.
  • Recovery: Skip React panel; pivot to Twig cc-acquia-source-card SDC (same data, no React).

R7 — ECA model acquia_source_ingest fails (TODO plugin IDs)

  • Break: Generated model has TODO_action_acquia_fetch placeholders. Plugin not found. Ingestion never fires.
  • L: H | Blast: high
  • Detection: drush eca:list doesn't show enabled, OR drush eca:run-model acquia_source_ingest → PluginNotFoundException.
  • Mitigation: TODAY: drush eca:export acquia_source_ingest | grep -i todo. Replace TODOs from drush eca:plugin:list action. If unfixable: do not enable; use imperative fallback.
  • Recovery: drush scr .agents/proposed-acquia/fixtures/manual_ingest.php writes same ai_context_item rows.

R8 — drush eca:run-model blocks 60s+; appears frozen

  • Break: Sync ECA against live Acquia API takes 30-90s. Audience sees frozen spinner.
  • L: H | Blast: med (perception)
  • Detection: Stopwatch >10s with no output.
  • Mitigation: Pre-warm: trigger model 5 min pre-demo to hot caches. cc-trace-flow-viz shows loader animation.
  • Recovery: Narrate ("...policy gate evaluating six Cedar rules..."). >45s → Ctrl-C, fixture replay.

R9 — Group perms block demo user from compliance dashboard

  • Break: Demo user in acquia_demo group; dashboard needs view compliance dashboard scoped to bluefly_internal.
  • L: M | Blast: high (audit is the punchline)
  • Detection: URL → 403.
  • Mitigation: TODAY: login as demo user, confirm 200. If 403, add to bluefly_internal OR drush role:perm:add to acquia_demo.
  • Recovery: Switch login to admin (have drush uli URL pre-staged). ~10s.

R10 — 14 stale Claude agent manifests fail validation

  • Break: Root .claude/agents/agent.yml uses legacy apiVersion: bluefly.io/v1alpha. Validator rejects → MCP tool surface empty.
  • L: L | Blast: med
  • Detection: drush ai:agents:list empty/errors; MCP list in studio empty.
  • Mitigation: move stale manifests to Scratch/stale-manifests-backup/. Keep only 3 demo-critical: acquia-source-ingest, governance-gate, audit-trail. bluefly-validate agents → exit 0.
  • Recovery: None mid-demo. Skip "show me the tools" beat; go straight to audit trail.

R11 — /api/contractplane/tenant route unresolved

  • Break: Team D tenant-resolution in-flight. 404 → ECA RouteNotFoundException → policy gate skipped → audit row missing tenant.
  • L: M | Blast: high
  • Detection: curl -i http://stage/api/contractplane/tenant → 404.
  • Mitigation: If still 404 by T-12h, hardcode tenant_id = 'acquia-demo-001' in ECA model. Add routing.yml stub serving .agents/proposed-acquia/fixtures/tenant.json.
  • Recovery: Apply same hardcode live via drush scr snippet (~5s).

R12 — Cedar denies everything (deny-by-default + missing permits)

  • Break: cedar_policy.ai_data_sovereignty.yml deny-by-default with no matching permit for Acquia ingest. Every request denied.
  • L: M | Blast: high
  • Detection: Audit log 100% denies; UI shows "blocked by policy" everywhere.
  • Mitigation: TODAY: drush cedar:simulate '{"action":"acquia.ingest",...}' must return ALLOW. Verify all 6 demo actions ALLOW.
  • Recovery: drush pmu cedar_policy -y && drush cr. Use pre-recorded overlay. Data flow is the punchline, not policy.

R13 — Demo URL hits IP allowlist; viewer can't load

  • Break: Stage restricts to Bluefly office IPs. CDN 403s from Acquia HQ.
  • L: L | Blast: high
  • Detection: "Access Denied — IP not allowed".
  • Mitigation: Request Acquia HQ public IP range from host; add to allowlist. Add hotspot IP. Fallback: unrestricted *.contextcontrol-demo.ai subdomain pre-tested from cellular.
  • Recovery: Switch to unrestricted subdomain (bookmarked). Re-login via drush uli.

R14 — "Show me the source code" — repo state is messy

  • Break: Repo has .agents/proposed-*/, deleted recipes, uncommitted submodules. Chaotic on screen.
  • L: M | Blast: low (cosmetic; credibility hit)
  • Detection: Acquia engineer asks to see GitLab.
  • Mitigation: Pre-curated branch acquia-demo-clean: demo-critical modules only, .agents/ gitignored, clean git status. Push today. Bookmark.
  • Recovery: "Let me show you the demo branch" → tab to clean branch. Keep working dir off-screen.

14 risks. Highest L×blast: R1 (LSP), R3 (token), R7 (ECA TODOs), R12 (Cedar deny-all). Sign-off T-12h: every R# green OR fall-back exercised. Owner: [email protected].