# Action Register: 2026-07-15 Kafka file-download consumer-group replay and Nearmap throttling

Incident: `INC-2026-07150002`  
Status: **Monitoring / Remediation Pending**

| ID | Priority | Status | Owner | Due | Action | Verification |
| --- | --- | --- | --- | --- | --- | --- |
| ACT-0001 | P0 | in_progress | Kafka File Download Service Owners | 2026-07-16 | Complete, merge, release, and verify the #4241 remediation set | Required adjacent blockers are resolved or linked to explicit approved follow-ups; PR merged; exact commit built and promoted; production group remains FILE-DOWNLOAD-group; valid offset continuity is proven; rollout has no replay surge, 429 spike, DLQ growth, credential/signed-URL leakage, or stale on-prem overlay; CI and client-like checks pass. |
| ACT-0002 | P0 | accepted | Aerialytic Data Recovery and Kafka Platform | 2026-07-16 | Recover failed jobs with deduplication and provider-wide rate bounds | Signed recovery manifest; deduplicated request count; provider-rate budget; dry-run approval; bounded execution receipts; customer workflow verification; residual DLQ disposition. |
| ACT-0003 | P0 | in_progress | Aerialytic Incident Response and Data Engineering | 2026-07-16 | Produce exact impacted customer and job inventory | Versioned deduplicated inventory with query hashes, inclusion/exclusion rules, unresolved records, and customer/job counts. |
| ACT-0004 | P0 | accepted | Aerialytic Customer Success and Support | 2026-07-16 | Complete customer recovery and approved communications | Approved communication log and per-customer recovery confirmation linked to the deduplicated impact inventory. |
| ACT-0005 | P1 | accepted | Aerialytic Release Engineering | 2026-07-17 | Add offset-continuity and cancellation deployment gates | Negative CI fixtures for group drift; approved migration override contract; cancellation/reconcile integration test; production release evidence includes before/after group and offset checks. |
| ACT-0006 | P1 | in_progress | Aerialytic SRE and Observability | 2026-07-17 | Ship 429, DLQ, replay-pressure, and group-drift alerts with runbook #4244 | Issue #4244 closed with alert-rule tests, synthetic threshold exercises, dashboards, paging destinations, and runbook drill evidence. |
| ACT-0007 | P1 | accepted | Aerialytic Cloud Platform and Security | 2026-07-22 | Restore production workload log retention | Retention policy approved; deleted-pod log retrieval test passes; signed URL and credential redaction tests pass; access and cost controls documented. |
| ACT-0008 | P1 | accepted | Aerialytic Iframe Product and Frontend | 2026-07-22 | Add customer-facing error correlation and actionable design failure states | Browser test reproduces a controlled provider failure and verifies a stable safe code, correlation ID, support path, and matching server trace. |
| ACT-0009 | P0 | accepted | Kafka File Download Service Owners and SRE | 2026-07-17 | Add provider-wide header-aware rate control and circuit breaking | Multi-replica load tests prove one shared budget, header-aware pause/reset behavior, bounded attempts, circuit-open behavior, and no provider overrun at 1/3/5-pod scale. |
| ACT-0010 | P0 | accepted | Kafka Platform and File Download Service Owners | 2026-07-17 | Harden Kafka consumer ownership, buffering, and crash consistency | Tests cover responses over the size cap, 30-second-plus provider stalls, rebalances during eachMessage, crash points around output/DLQ and offset commit, and duplicate request identifiers. |
| ACT-0011 | P0 | accepted | Kafka File Download Service Owners and Application Security | 2026-07-16 | Remove file path traversal and root-container exposure | Traversal, encoded traversal, absolute-path, symlink-escape, and valid nested-path tests pass; runtime securityContext proves non-root and least-privilege mounts. |
| ACT-0012 | P0 | in_progress | Aerialytic Security and Cloud Platform | 2026-07-16 | Remove credential-bearing startup logs and rotate exposed Kafka/TLS material | Code/log scans show no secret-bearing object logs; exposure assessment is signed; affected credentials are scoped and rotated; old credentials fail; workloads recover without printing secret values. |
| ACT-0013 | P1 | accepted | Aerialytic Release Engineering | 2026-07-17 | Make incident contracts hard release gates on the actual artifact | A deliberately broken group, retry, secret-log, health, and stale-overlay fixture each blocks release before deployment; promoted image digest and runtime overlay hashes match the tested release evidence. |
| ACT-0014 | P1 | accepted | Kafka File Download Service Owners | 2026-07-18 | Make health checks reflect the live consumer run loop | Fault-injection tests terminate or stall the consumer and prove readiness/liveness transitions, alerting, and bounded restart behavior. |

## Completion Rule

An action is not complete because code exists. Completion requires the listed verification method and linked evidence. Production rollback health, candidate source readiness, merged CI, deployed artifact state, and customer recovery are tracked separately.