Operations Continuity Plan

The “if the Director of Operations is suddenly unavailable” runbook — what the LMR digital system is, what has to keep running, who to call, and where everything lives. Written so someone who is not the person who built it can keep the lights on.

Read this first. Most of LMR’s digital operation was built and is run by one person (JB). This page exists so that if he’s out — a week, or for good — the org can keep the sites up, keep the data flowing, and know exactly who to lean on. It points to where things live and who holds the keys; it deliberately contains no passwords or secret keys (those live in the vault noted below).

Progress — September 13, 2026. Continuity is now real on three of four fronts: (1) Files — the toolchain’s code & docs are copied to an organization-owned Google Shared Drive, “LMR Operations — Toolchain & Docs,” with JB and Michelle Martin as Managers, so they survive any one account being lost. (2) Admin control — both planes are redundant: Google Workspace (the Shared Drives) and Microsoft 365 (email & identity) each list JB, Michelle, and the shared info@letmerun.org as admins. (3) The data — new since July: the database itself now has a weekly rollback copy that lives somewhere other than one laptop (Section 3). (4) The one open item is the secrets vault — the keys & logins still live on JB’s laptop; a shared password manager (“LMR Ops Secrets”) is being set up (see the last section). Until it exists, a successor can reach the files and both admin consoles but would still recover vendor passwords the hard way (resets via the Microsoft 365 mailboxes).

Break glass If Jason is unavailable — start here (Michelle)

Work these in order. Nothing here is urgent in the first hour — the public website and registration keep running on their own, and the staff tools keep showing the last good data. Breathe first, then go top to bottom.

You already have the access. You are a Google Workspace Super Admin, a Microsoft 365 Global Admin, and a Manager on both Shared Drives — “LMR Operations — Toolchain & Docs” (the code) and “LMR Operations — Data (Restricted)” (the database rollback copy). Nothing to request or unlock.
Open the Shared Drive. Google Drive → Shared drives → “LMR Operations — Toolchain & Docs.” Everything lives there — the code, the docs, and this plan. Start by reading LMR_Master_Context.md (the deep map) and this page.
Get the keys. Open the “LMR Ops Secrets” vault (Bitwarden) — every password and key is there, shared with you.
Until the vault is set up: the keys are on Jason’s laptop. You can still recover most vendor logins by resetting their passwords through the letmerun.org mailboxes in Microsoft 365 (which you admin) — that’s why the M365 access matters.
Keep the sites running. dashboard.letmerun.org and coaches.letmerun.org run themselves off the database. If one won’t load, roll it back: Netlify → the site → Deploys → Publish the last good deploy.
Keep the rosters current — this is the one routine that cannot drift. The daily refresh (Section 2 below) is a manual routine on Jason’s machine, and it does two jobs. The Dashboard’s numbers can go a week without harm. The Coach Hub rosters cannot — every day it doesn’t run is a day of new registrations invisible to the coaches who need them at practice. If you keep only one routine going in week one, keep this one, on weekdays, with a technical helper if needed.
If letmerun.org (the public website) breaks — that’s WordPress on WiT’s hosting. Call WiT (Section 4). You can’t fix that hosting yourself, and that’s expected — it’s their job.
Bring in a technical hand. For anything that means running or changing the code, hire or borrow a technical person and hand them three things: the Shared Drive, the vault, and this plan + Master Context. That is genuinely everything they need to keep it running or rebuild it.
Then read the rest of this page — the full map of every system, who to call, and how each piece recovers.

1 · The 30-second picture

LMR’s digital system is one data source feeding three tools. Families register in Pinwheel (pinwheel.us). Everything else is a downstream view of that:

                         PINWHEEL  (system of record — families register here)
                                  |
                 +----------------+------------------+
                 |                                   |
        nightly auto-sync                    manual Excel export  --> JB's laptop
                 |                                   |
                 v                                   v   (local Python turns exports into data)
       WordPress (letmerun.org)          +-----------+-------------------+
                 |                        |           |                   |
                 v                        v           v                   v
      1) PUBLIC TEAMS LIST      2) STAFF DASHBOARD    3) COACH HUB
         letmerun.org/regions      dashboard.letmerun.org   coaches.letmerun.org
         (public)                  (staff login)            (coach login)

Tools 2 and 3 read a shared database (Supabase) and are refreshed by a manual daily routine JB runs. Tool 1 (the public teams list) refreshes itself live from Pinwheel — see the Resources card “How the Public Teams List Gets Its Data.”

2 · The one job that must not stop: the Daily Refresh

Once a day, the staff Dashboard and Coach Hub need fresh registration and roster numbers. Today this is a manual routine on JB’s Windows laptop, not an automatic server job:

Download the current Pinwheel exports (Seasonal Participant Details + Assigned Volunteers) to the laptop’s Downloads folder.
Double-click LMR_Daily_Refresh.bat in C:\Users\jmbai\OneDrive\LMR. It runs three scripts that read the exports and push the data into Supabase.
Confirm each report says it reached Supabase, then spot-check both live sites.

If the refresh is skipped, nothing is lost and nothing is corrupted — but two very different things go stale at two very different speeds, and they are worth keeping apart:

The staff Dashboard’s figures can wait. Registration counts, money, goal progress — these are for staff, and a week-old number is an inconvenience, not an emergency.
The Coach Hub rosters cannot. The list of boys a coach opens on the touchline is whatever the last refresh loaded. A boy who registered this morning is invisible to his coach until this runs, and a brand-new team does not appear at all. In season that means a coach taking attendance against a roster missing children who are standing in front of him. The Hub stamps every roster with when it was last updated, so a coach can see that it is stale — seeing it does not fix it.

The public teams list is unaffected either way (it’s live from Pinwheel). So: a missed day is an inconvenience and a skipped weekend is acceptable — almost no team practices Saturdays — but a missed week in season is not. Weekdays are the requirement.

Status (Sep 13): Michelle can reach the toolchain (she is a Manager on both Shared Drives) and administers both admin planes. Still open: no one other than JB has ever run the refresh, and the secrets it needs are still on JB’s laptop (vault in progress). So the nearest backup today is Michelle working with a technical helper, following the daily-refresh runbook — closing the vault is what makes it fully real. A supervised dry-run by a second person is the cheap move nobody has made yet.

3 · The database itself: the weekly rollback copy

Everything staff type into the OS — coach assignments, notes, compliance dates, supply orders, merges, signed documents — lives only in Supabase. Pinwheel can regenerate the registration data; it cannot regenerate any of that. So once a week the whole database is exported to files and a copy is put somewhere other than this laptop.

How it runs. Double-click LMR_OS_Export_COMMIT.bat. It reads every table (about 100) and writes them as files to C:\LMR_OS_Export\<date>. It takes roughly three minutes and it only ever reads — the script has no way to write to Supabase.
How you know it worked. Double-click LMR_OS_Export_Due.bat. It only reports a good export if the folder’s own manifest is present and the “do not rely on this” marker file is gone, so a run that died halfway can never look finished. The daily refresh also re-checks the newest copy every morning and says so in its report.
Where the off-machine copy lives. The Google Shared Drive “LMR Operations — Data (Restricted)” — a second, separate drive whose only members are JB and Michelle, both Managers. Drag the dated folder there after each run and keep the newest three or four.
What it is not. It is a rollback copy, not a restore button. Nothing yet reads these files back into Supabase — that tool would have to be written on the day. The files are the raw material; having them is the difference between a bad week and an unrecoverable one.

This folder holds minors’ personal data — names, dates of birth, guardian contacts, addresses, allergies, medications. It belongs in the Data (Restricted) drive and nowhere else: not the Toolchain drive (which has Viewers), not a personal OneDrive or Google Drive, never an email attachment. The export script refuses to write into any folder that syncs to a cloud account, and the Data drive is set so that files cannot be shared with anyone who is not a member.

4 · The systems & who holds the keys

Every moving part, what it does, and where access lives. Fill in the blanks only you can answer.

System	What it does	Access / where the login lives
Pinwheel (pinwheel.us)	Registration — the system of record for every boy, coach, team, and payment.	LMR Pinwheel admin account. key person
WordPress + Divi — letmerun.org	The public website, incl. the regional teams lists.	WP admin login. Built by WiT Group, maintained by JB.
WP Engine (hosting)	Hosts WordPress; holds server-level backups.	Only WiT has portal access — LMR does not. single point
Netlify	Hosts the Dashboard & Coach Hub + their serverless functions. Deploys happen here.	Netlify account. Sites: `super-melba-887aa5` (Dashboard), `rainbow-trifle-740737` (Coach Hub).
Supabase	The secure database behind both staff tools — where PII (emails/phones) and OS data live. Backed up weekly — Section 3.	Supabase account (project `yvrxssdyenuqkugwzxgo`).
Resend	Sends the 6-digit sign-in code emails (from `info@letmerun.org`).	Resend account.
Raceplanner / Pinwheel API	Live team data for the public teams list.	Token stored server-side (Netlify env var) + in the WP sync plugin. Reissued by WiT.
DNS — Cloudflare	Points letmerun.org + every subdomain at the right host. This is where DNS actually lives — not at the registrar. DNSSEC is on.	Cloudflare account. Nameservers `nash`/`mia.ns.cloudflare.com`. key person
Registrar — GoDaddy	Owns the `letmerun.org` registration itself and holds the DNSSEC record. It does not serve DNS.	GoDaddy account (2-step on, domain lock on, recovery address off-domain).
Google Workspace	Hosts two Shared Drives: “LMR Operations — Toolchain & Docs” (the code + docs) and “LMR Operations — Data (Restricted)” (the database rollback copy, Section 3).	Super admins: JB, Michelle, `info@`. Managers on both drives: JB, Michelle. redundant
Microsoft 365	Email & identity (letmerun.org mailboxes) — the plane that recovers vendor logins via password-reset emails.	Global admins: JB, Michelle, `info@`. redundant

Jason: still to fill in — (a) WiT Group’s contact name, email, and phone (the one outside party who can touch the website + hosting); and (b) which account/email each vendor above is registered under — ideally consolidate them onto info@letmerun.org so an admin can always recover them. The passwords themselves go in the LMR Ops Secrets vault (last section), never in this document.

5 · Single points of failure (the honest list)

These are the places where “one person or one machine” is the whole story. Reducing them is the point of the Google Shared Drive move and the fill-ins above.

The secrets still live on one laptop. The code & docs are now mirrored to the org-owned Shared Drive (JB and Michelle as Managers), so the toolchain files survive. What’s still laptop-only is the secrets — the Supabase service key in lmr_config.py plus the vendor tokens and logins. Until the shared vault exists, losing the laptop means recovering those keys the hard way (vendor resets through the Microsoft 365 mailboxes). The vault is the last step.
Only WiT can reach WP Engine. LMR cannot pull its own website/server backups; if the site goes down, the path is call WiT, not self-serve. Recommended fix (small lift, not a project): have WiT add LMR as a user on the WP Engine account so LMR isn’t locked out of its own hosting.
Deploys are manual. Updating the Dashboard or Coach Hub means dragging a folder onto Netlify by hand. No CI, no automation — whoever does it needs the Netlify login and the folder.
The knowledge is written down in a few key files (below), but they assume a fair bit of context. A successor should read them with a technical helper the first time.
Only Jason has ever run the daily refresh, and only Jason uploads the weekly database copy. Both are written down and both take minutes, but neither has been exercised by a second person, and the upload is the one step no script can check — it depends on the habit. A single supervised dry-run by Michelle would retire most of this line.

6 · If something breaks — quick triage

Symptom	First move
letmerun.org is down or broken	Contact WiT Group — it’s their WordPress/WP Engine stack. LMR can’t fix hosting directly.
Dashboard or Coach Hub won’t load	Check Netlify (is the site up? recent bad deploy? roll back to the prior deploy in Netlify’s Deploys tab).
Nobody can sign in (no code email)	Check Resend (is it sending?) and Supabase (is the project up?). The code emails come from `info@letmerun.org` via Resend.
Sites show stale numbers	The daily refresh hasn’t run. Not urgent — run it when possible (Section 2).
Public teams list looks wrong	Decide if it’s a Pinwheel field (fix in Pinwheel) or an LMR field (fix in the Dashboard). See the “How the Teams List Gets Its Data” card.

7 · Where everything is written down

The deep knowledge lives in a small set of files in C:\Users\jmbai\OneDrive\LMR (the older path C:\Users\jmbai\LMR still reaches the same folder), and mirrored on the Toolchain Shared Drive:

LMR_Master_Context.md — the single source of truth: architecture, infrastructure, brand, locked decisions. Start here.
CLAUDE.md — the working “glance” state and conventions.
LMR_Pipeline.md — the backlog / future work.
LMR_Recovery_Runbook.md & the various *_Deploy_Runbook.md — step-by-step recovery and deploy procedures.
The daily refresh procedure — captured as the daily-pw-report routine.
LMR_OS_Export_Runbook.md — the weekly database export: how to run it, how to tell a good run from a half-finished one, and where the copy goes.
memory\ — a folder of short topic notes recording decisions and the reasons behind them.

These files are the org’s memory. The most valuable single action for continuity is making sure they are backed up off the laptop and readable by more than one person — they live in the org-owned Toolchain Shared Drive, with JB and Michelle as Managers. This is a copy, not a mirror: it is refreshed by hand, and between July 14 and September 13 2026 it sat untouched while the folder moved on — so re-running that copy is part of the routine, not a one-time task. The secrets vault below is the one remaining piece.

8 · The one open item: the secrets vault in progress

This is the last leg. The Shared Drive holds the code; the vault holds the keys that make it run. Plan: one shared password-manager vault named “LMR Ops Secrets” (Bitwarden pricing requested Jul 14, 2026), shared with JB and Michelle, each with their own login + two-factor. When it exists, everything below moves off JB’s laptop into it:

Supabase — project URL, the service key, and the anon key.
Netlify — account login + a personal access token.
Pinwheel / Raceplanner — the Pinwheel admin login + the API token.
WordPress / WP Engine — the WP admin login, and (once obtained) LMR’s own WP Engine access; the WiT contact until then.
Resend — account login + API key (sends the sign-in codes).
Cloudflare — where DNS is actually served from.
GoDaddy — the domain registrar login (registration + the DNSSEC record).
Break-glass admin — the info@letmerun.org password, and the Google Workspace + Microsoft 365 admin recovery details.
A secure note with the full contents of lmr_config.py, so the file can be recreated on a new machine from scratch.

Once the vault is done, this plan is complete — files (Shared Drive), control (two redundant admin planes), and keys (vault) will each have more than one living person who can reach them.

Internal continuity plan — for LMR leadership & board. Two “Jason: fill in” items remain (WiT contact + vendor account emails), and the secrets vault is being set up. Revisit whenever a vendor, account owner, or the backup person changes. Last structural update: September 13, 2026 — added the weekly database rollback copy (Section 3), corrected DNS to Cloudflare, and reduced the named backup people to JB and Michelle.