Chapter 1 — Introduction & Scope

1.1 Document Purpose

This document (LH-SBS-INF-001) is the authoritative infrastructure specification for The Dash — SBS's Multi-Gated AI Orchestrator Platform, designed by Ledger Hub Networks exclusively for SBS. It defines the complete DigitalOcean hosting environment on which the Platform operates: network topology, DNS and domain architecture, TLS and edge security, compute and storage layers, secrets management, identity integration, infrastructure-as-code practice, observability, audit infrastructure, and backup and disaster recovery.

The specification serves three functions. First, it is the build reference: every infrastructure resource provisioned for the Platform must conform to the configurations stated herein, and any deviation requires a documented change under the governance forms in effect for the engagement (LH-SBS-CO- series). Second, it is the verification baseline: the acceptance gates defined in LH-SBS-INST-001 (V1–V22) test the environment against this document. Third, it is the operating reference for the IT execution owner (Nelson Santos, IT Director) and any personnel subsequently authorized to administer the environment.

This document is 100% technical in content. Commercial terms, fees, and engagement governance are out of scope and are addressed in their respective controlling documents.

1.2 Platform Context

The Dash is deployed inside a DigitalOcean Virtual Private Cloud (VPC). All internal service-to-service traffic remains on the private VPC network; public exposure is restricted to hardened entry points in two classes.

Tenant surfaces (three-subdomain tenant model):

sbsdash.com — primary tenant surface
admin.sbsdash.com — administrative console
clients.sbsdash.com — client-facing surface

Operational surfaces:

monitor.sbsdash.com — observability stack (Grafana dashboards, Prometheus metrics); access restricted to authorized operations personnel via IdP-enforced authentication
wiki.sbsdash.com — documentation portal; hosts platform runbooks, configuration references, and operational procedures

Operational surfaces carry no tenant data and sit behind the same TLS, reverse-proxy, and firewall controls as the tenant surfaces, with access scoped to administrative roles only under the least-privilege model of the IAM family in LH-SBS-SEC-001.

Each of the ten functional Compartments is isolated across eight layers — frontend, authentication, application, data, storage, secrets, network, and audit — and this specification defines how each isolation layer is realized in infrastructure: firewall rule sets and VPC segmentation (network), per-Compartment database and object-storage separation (data, storage), Vault namespace separation (secrets), and hash-chained log capture (audit). Every AI Agent decision on the Platform is tagged by Risk Tier and written to the immutable audit log; the infrastructure supporting that log — its storage, integrity chain, and retention — is specified in Chapter 13.

The environment follows a zero-trust posture per NIST SP 800-207 and application controls aligned to OWASP ASVS L2, with AI-specific controls addressing the OWASP LLM Top 10 (including LLM01 prompt injection) as carried in LH-SBS-SEC-001.

1.3 Referenced Documents

Document ID	Title	Relationship to this Specification
LH-SBS-KO-001 V3.2	Technical Install and Discovery	Master runbook. This specification elaborates the infrastructure control families imported into KO-001 from the Foundation Install Spec (Vault, IaC, supply-chain, observability, backup/DR, hash-chained audit, identity depth, WordPress isolation).
LH-SBS-SEC-001 V1.0	Security & Access Control Specification	Controlling security baseline. The 36 controls across the DNS, TLS, IAM, APP, AI, INF, FE, and MON families constrain every configuration stated in this document; the INF family maps directly to Chapters 2–8, and the MON family governs the observability surface at monitor.sbsdash.com (Chapter 12).
LH-SBS-PRE-001	Pre-Install Prerequisites	Gate conditions. The nine prerequisite gates must be satisfied before any resource defined in this specification is provisioned (Day 0).

Where this specification and LH-SBS-SEC-001 address the same control, LH-SBS-SEC-001 states the requirement and this document states the implementation. In the event of conflict, LH-SBS-SEC-001 controls and this document shall be corrected.

1.4 Audience and Ownership

Primary audience: Nelson Santos (IT Director, execution owner for DNS, IdP, proxy, firewall, and SCIM items — including the DNS records for all five public subdomains) and Ledger Hub Networks platform engineering. Document owner: Ledger Hub Networks, LLC. Review coordination: Alexandra Del Rey (Chief of Staff / Security-Compliance). The documentation portal at wiki.sbsdash.com is the publication target for the operational content of this specification once finalized.