11. Known fragilities and the improvement backlog

This chapter lists what is currently fragile in the operation and what would fix each item. It is written without addresses, account names, identifiers or file paths, because a list of weaknesses with the coordinates attached would expose more than it should. Those coordinates live in the restricted infrastructure reference. Each item carries the date someone last confirmed it. An undated item cannot be acted on. If a system described here as broken has since been fixed, that is also a defect that needs correcting.

#11.1 Single points of failure

Two of these affect the whole operation: the single role holder and the four-layer deploy. Each item carries the date someone last confirmed it.

• One person holds the role. As of 22 July 2026, one external Technical Advisor handles TC Administration for these TCs, running both the publication and the opening and running of the public review. The staff member who previously ran publication and public-review administration left OASIS in June 2026, and the duties merged rather than being split again. A gap in that person's availability affects OASIS's ability to publish a document, open a ballot or run a public review. This handbook mitigates that risk, provided someone keeps it current.
• The origin server has no friendly name. Its address is written into configuration rather than resolved through DNS. Moving or replacing that server means changing the address everywhere it appears instead of repointing one record. Confirmed 22 July 2026.
• The starter templates carry a credential in plain text. The templates used to set up a new TC publishing repository carry a credential in the clear, and it is copied into every repository created from them. The recorded fix is to rotate the credential, strip it from the history of every affected repository, and hold it in the platform's secret store. Confirmed 22 July 2026.
• Two systems the operation used to depend on are no longer functioning and are worked around. The legacy mailing-list host is unreachable, and TC and comment mail sent to it fails without any error for roughly two days before bouncing, so an announcement can appear to have gone out when no one received it; distribution goes through community posts on the member platform instead (confirmed 15 July 2026). The public open-reviews listing page returns not-found, the category filter is ignored, and no matching category exists in the website, so announcements link the news feed instead (confirmed 20 July 2026). Someone must confirm both again before this handbook ships.
• The templates surface had no version-controlled source until 21 July 2026. Until that date the published templates were edited directly on the server, with a dated copy saved beside the live file as the only history. As a result, for fifteen months the surface told TCs that templates the Board had approved were undownloadable. It now has a version-controlled source and a deploy that is screened before it runs, and that deploy only adds and never deletes, because live documents cite the published templates. The first sweep of the surface's links, run on 21 July 2026, found all 18 TC Administration request forms pointing at a former staff member's personal domain, every one returning not-found, with addresses built from stage abbreviations retired in January 2024. A live OASIS process page currently routes members to a third-party personal domain. The current entry point for TC Administration requests is the request page on the main OASIS website.
• The request tracker cannot report on itself. As of 22 July 2026 the request type is not machine-readable, because all 142 tickets raised in the last 24 months are filed as a generic task while the 20 purpose-built request types sit unused. The requester's identity is not captured either: 83 of those tickets were filed by the shared intake account and 53 carry no reporter, and only 5 carry a named requester from a TC. As a result, the record cannot show how many public reviews were opened last year, or which TCs ask for what. Section 9.4 states both findings with their method. One knock-on effect: the intake form is open to the public and spam reaches the queue, six submissions of it inside the recent window.
• No turnaround is committed. The contract OASIS states to its TCs commits no turnaround from request to publication, and no internal service level exists either. What exists is an observed record, reported in 9.4 with the three limits that make it a record-keeping measure rather than a service-level one. Whether OASIS should commit a turnaround is an open decision, carried in 11.2.

The deploy is manual and runs from a staff workstation. A publication moves through four layers, and all four run in order, every time:

1. The publication is copied to the origin server.
2. It is synced to the object store behind the content delivery network.
3. The delivery network distribution is invalidated.
4. The domain and cache layer above it is purged by path prefix.

The credentials for each layer are held on a staff workstation. Two of the automated deploy steps that once existed stopped working after an infrastructure migration and were not replaced, which is why the sequence is run by hand.

#11.2 Improvement items and owners

Owners below are as recorded in the source that carries each item. Where the recorded owner is a role that no longer exists at OASIS, that is stated rather than reassigned. An item with no owner is written as having none.