# Cascades of Tucson — Roadmap additions + finish-line refresh

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Continued from the 7/15 technology-plan-final session (see that log's Update sections for
the live verification sweep and jodi.ramstack decommission). This session extended and then
fully refreshed the Cascades execution roadmap (`docs/REMAINING-WORK-PLAN.md`).

First, per Howard's strategic direction, two new workstreams were added: **WS8 — M365
collaboration migration (SharePoint / Teams) — HIPAA lockdown** (dept shares on CS-SERVER +
Synology move to SharePoint libraries with role-based permissions from the AD dept groups;
Teams/OneDrive; audit logging, retention, DLP, sensitivity labels, external sharing off;
covered by existing Business Premium licensing; sequenced after the domain-migration tail),
and **WS9 — ALIS online payment system** (Medtelligent vendor conversation, business-office
coordination with Jeff Bristol, BAA tracker tie-in, KPI dashboard tie-in). A matching row
was added to the CARF tech plan Area 2 (SharePoint/Teams move) and the plan PDF re-rendered.
An 18-question Medtelligent scoping doc was drafted at
`docs/proposals/alis-online-payments-scoping-2026-07-15.md`.

Second, WS3 gained **step 3b**: nurse-station desktops NURSESTATION-PC + ASSISTNURSE-PC
(explicitly NOT the medtech laptops) get phone-parity shared login — any caregiver signs in
with their own `cascades\` username, gets ALIS via SSO and the same standardized desktop
shortcuts as the phones, delivered per-machine/all-users via the `CSC - Caregiver Workstation`
GPO. The canonical shortcut list must be captured from a phone home screen before building.

Third, on Howard's directive ("update the plan/roadmap … getting them finished"), the whole
REMAINING-WORK-PLAN got a **FINISH-LINE PASS**: a refreshed header block folding in the 7/15
live-verification results, jodi decommission, CARF plan finalization, Synology-sync correction,
and 21.5-hr block; per-workstream reconciliation (WS3 CA posture dates, WS4 relicensing math,
WS5 backup/image-staleness gate + pfSense ACB, WS6 live port/switch counts, WS9 drafted
status); and the sequence re-cut as a 10-step close-out order ending with a ticket-verify
pass with Howard.

## Key Decisions

- Verification discrepancies were folded into the internal ROADMAP but deliberately NOT into
  the client-facing tech plan (Howard: "leave the rest alone and do not add").
- Nurse-station scope limited to the two desktops; medtech laptops explicitly excluded.
- WS8 sequenced AFTER the domain-migration tail — don't build SharePoint permissions on the
  pre-migration flat-share model; Synology backup-only flip follows the SharePoint move.
- WS9 marked parallelizable (vendor-driven); scoping questions drafted but NOT sent — Howard
  declined an email-ready version for now.
- Relicensing recalculated: 29 suspended-Standard users remain vs only 4 free SPB seats —
  seat-mix decision (full vs lighter licenses, ~$375–575/mo per CARF plan) required before
  any license moves.
- Image/system-state backup (~10 days stale on 7/15) made an explicit GATE before the SSD swap.
- Tech plan PDF footer still shows stale 37.5 hrs (live 21.5) — left as-is per Howard
  ("dont send this as a PDF").

## Problems Encountered

- 3b was initially stamped "ADDED 2026-07-16" (date confusion mid-session); corrected to
  2026-07-15 during the refresh pass.
- (Carried from 7/15 log: `UID` readonly in Git-Bash, jodi mailbox already deprovisioned by
  the suspended sub, rebase/push race with Mike's MacBook sync — all resolved there.)

## Configuration Changes

- `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md` — WS8 + WS9 added; WS3 step 3b added;
  FINISH-LINE refresh header; WS3/WS4/WS5/WS6/WS9 reconciled to live 7/15 state; sequence
  re-cut to 10 steps.
- `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md` + `.html` +
  `.pdf` — Area 2 row added (SharePoint/Teams move); PDF re-rendered 436,003 bytes / 4 pages.
- `clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md` — NEW:
  18 Medtelligent scoping questions in 5 groups + internal notes.

## Credentials & Secrets

- None new this session.

## Infrastructure & Servers

- Cascades M365 tenant `207fa277-e9d8-4eb7-ada1-1064d2221498`; SPB 45 enabled / 41 consumed;
  suspended Business Standard 29 consumed (post-jodi).
- CA policies: off-network block `e35614e1` (enabled 2026-04-29; trusted IPs 72.211.21.217/32,
  184.191.143.62/32), sign-in frequency `7d491c7a`, allow-list `1b7fd025` (report-only,
  test-scoped), compliance-block `ede985e2` DISABLED (do not re-enable).
- ALIS: cascadestucson.alisonline.com, communityId 622, SSO appId
  `d5108493-cba8-4f08-90b6-1bb0bc09eb2a` (secret to 2028-05-06).
- UniFi live 7/15: 11 switches, 77 APs, voice VLAN 37 devices, 34 ports @100Mb + 5 AP uplinks
  sub-gig. Controller 172.16.3.29:11443 site `va6iba3v`.
- MSP360: daily file backup current; image/system-state ~10 days stale (gate for SSD swap).
- pfSense AutoConfigBackup not enabled.

## Commands & Outputs

- Roadmap edits via Edit tool only this session; no external commands of note.

## Pending / Incomplete Tasks

1. **Juan Andrade offboarding — was due 2026-07-16 afternoon** (coord todo `80716a98`) —
   VERIFY it happened; if not, do it now.
2. Break-glass accounts + FIDO2 + strip stranded PAA role (blocks the allow-list flip).
3. Caregiver lockdown go-live (WS3 1–8 incl. 3b; capture phone shortcut list onsite).
4. Relicense 29 suspended-Standard users (seat-mix decision first).
5. Image backup repair/confirm -> SSD swap window.
6. Domain-join tail (~10 machines) + dept drives + printer GPO.
7. Network tail (CSC ENT island, gig sweep) + audit-retention build.
8. WS8 SharePoint/Teams scoping (after WS1/2 tail).
9. WS9: send scoping questions to Medtelligent (drafted, not sent), cc Jeff Bristol.
10. Ticket-verify pass with Howard (#32194/#32230/#32254/#32319/#32342/#32370).
- Tech plan: "we will come back to the tech plan" (Howard); PDF footer hours stale by choice.

## Reference Information

- Roadmap: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`
- Tech plan: `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.{md,html,pdf}`
- ALIS scoping: `clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md`
- Prior log (verification + jodi decommission evidence):
  `clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md`
- Wiki commit from 7/15 recompile: `7e15257`; coord todo Juan Andrade: `80716a98`
- Syncro customer 20149445; prepaid block 21.5 hrs (live 7/15)