Manual Test Runbooks (X6)¶

The human-gated artifact that lets an asset move from 🟦 code-complete to 🟩 shipped per claude.md §11. Every shippable asset gets one of these — a step-by-step, sandbox-executable script that proves the asset works as built.

Run them in order, not alphabetically: SEQUENCING.md defines the canonical phase-by-phase execution sequence (dependency-aware, ~6–8 hours total), starting with the one-time Azure Cloud Setup (Phase 0). Template and update protocol: docs/context/09-testing-dod.md §10.2.

This page is the alphabetical reference index — use it to jump straight to a specific asset's runbook. Code → human-readable name lookup: docs/context/00-asset-glossary.md. Full per-asset detail: docs/context/03-asset-catalog.md.

A — CRM & sales automation¶

Runbook	Covers
A1	HubSpot lead enrichment
A5	HubSpot discovery trigger

B — Bootstrap, identity & client onboarding¶

Runbook	Covers
B1	`snowops-onboarder` GitHub App
B2	Client-Bootstrap (AAD App Reg + Federated OIDC)
B3	Subscription Baseline (F1 + Group RBAC + MCSB)
B4	Client State Backend (F6 + Blob RBAC)
B5	PIM for Azure Resources (Owner / Contributor / UAA)
B6	Client Self-Service Bootstrap

C — CI/CD pipelines & GitOps conventions¶

Runbook	Covers
C1	`terraform-plan-apply` reusable workflow
C2	`container-build-sign` reusable workflow
C3	`aks-deploy` reusable workflow
C4	GitOps branching standard + repo template

D — Quality gates & policy¶

Runbook	Covers
D1	Pre-Commit Quality Gates
D2	PR-Blocking Quality Gates
D3	D3 + X3: OPA / Conftest Policy Bundle
D4	D4 + X4: Kyverno Policy Bundle
D5	Policy Waiver Engine

E — Evidence, compliance adapters & detection¶

Runbook	Covers
E0	Lightweight Compliance Snapshot
E2	Vanta Adapter
E3	Drata Adapter Stub
E4	Resource Graph Query Library
E5	Evidence Sync
E6	Access Review Automation
E7	TicketPlatform Adapters

F — Terraform module library & contracts¶

Runbook	Covers
F0	Cloud-Agnostic Module Contracts
F1	Baseline Module
F2	Network Hub
F3	AKS Secure
F4	Azure Container Registry
F5	Azure Key Vault
F6	State-Backend Module
F7	Terragrunt Live-Infra Reference
F8	K8s Reference Manifests Bundle (ArgoCD app-of-apps)
F11	Module Versioning + Private Registry

F12 (Brownfield Import Library) lives in runbooks/import/F12.md — its own category, see below.

G — Discovery Auditor (G-series)¶

Runbook	Covers
G0	Client-side scoped Reader SP bootstrap
G1	Discovery collectors
G2	YAML rule pack + engine
G3	Report renderer
G4	Discovery run workflow
G5	HubSpot Deal attachment
G6	Immutable run audit log

H — Identity hardening, data stores & security ops¶

Runbook	Covers
H1	Azure AD Tenant Baseline
H2	Conditional Access Bundle
H3	PIM Eligible Role Templates
H5	Service Principal Inventory + Rotation
H7	Break-Glass Accounts + Sign-In Alert

I — Application security scanning¶

Runbook	Covers
I1	Container Image Scanning
I2	Dependency Scanning
I3	CodeQL SAST
I5	Defender → Ticket (via E7)

J — Logging, diagnostics & detection¶

Runbook	Covers
J1	Log Analytics Workspace
J2	Enforce Diagnostic Settings (Azure Policy)
J4	Detection Alert Rule Pack
J6	WORM Audit-Log Archive

K — Incident response & on-call¶

Runbook	Covers
K1	IR Runbook Library
K2	On-Call Integration

The IR runbook library itself is published at runbooks/incident/ — see Compromise, Data Leak, DDoS, Ransomware, Vendor Breach.

L — Backup, replication & disaster recovery¶

Runbook	Covers
L1	Azure Backup Policy Module
L2	Cross-Region Replication Module
L4	Automated Restore Drill

DR scenario runbooks (the client-facing templates these modules back) live at runbooks/dr/.

M — Encryption & data-residency policy¶

Runbook	Covers
M1	Deny Unencrypted Resources (Azure Policy)
M2	Customer-Managed Keys (HSM-backed, auto-rotation)
M3	Enforce TLS 1.2+ / HTTPS-only (Azure Policy)
M6	Data Residency (Allowed Regions Only)

N — Network security policy¶

Runbook	Covers
N3	WAF Policy Module
N4	DDoS Network Protection
N5	Deny Public Network Access on PaaS (Azure Policy)
N6	NSG Baseline + Flow Logs

R — Repo & change-management hygiene¶

Runbook	Covers
R1	PR template enforcement
R2	Production Change Log

S — Drift detection & compliance visibility¶

Runbook	Covers
S1	Scheduled Terraform Drift Detection
S2	Azure Policy Compliance Dashboard

U — Cost & tagging utilities¶

Runbook	Covers
U1	Subscription Budget + Alerts
U2	Require Mandatory Tags (Azure Policy)

V — Visualization & generators¶

Runbook	Covers
V2	Architecture Diagrams Generator
V3	Runbook Generator

X — Test infrastructure & sandbox utilities¶

Runbook	Covers
X1	SnowOps Sandbox Subscription
X2	Terratest Harness
X5	Pipeline Integration Tests
X7	Sandbox Cleanup Workflow
X8	Synthetic Monitoring

Sign-off status¶

Tracked centrally in SEQUENCING.md — see Quick Reference: Current Sign-Off Status. Update docs/context/06-project-state.md after each phase, and CLAUDE.md § Machine State once all runbooks are signed off.