# cbb-sign — Cost-Impact Analysis
# Cold Bore Ballistics LLC — Internal Reference
# Classification: Confidential
# Date: 2026-06-12
# Status: DRAFT — approval gate for provisioning

---

## Purpose

This is the **mandatory cost-impact analysis** required before any cbb-sign Azure resource is provisioned (CLAUDE.md — "Cost-impact analysis and approval before provisioning"). It states the added recurring cost, the new monthly total, and the cheaper alternatives considered. **No `terraform apply` for cbb-sign resources may run until the owner approves the cost stated here.**

---

## Summary

| | Monthly cost |
|---|---|
| **Current CBB Azure total** (per `Azure_Acquisition_Brief.md`) | **~$25–30** (first 12 mo, DB free-tier) → **~$37–45** after | 
| **cbb-sign incremental add** | **~$2–8/month** (estimate; see breakdown) |
| **New CBB Azure total with cbb-sign** | **~$27–38** (first 12 mo) → **~$39–53** after |

**The cbb-sign incremental cost is small because cbb-sign reuses existing infrastructure** — the Container Apps environment, PostgreSQL server, container registry, storage account, and Key Vault all already exist and are already paid for. cbb-sign adds two consumption-billed Container Apps (scale-to-zero), one new database on the existing server, and one new (small) blob container.

> **Figures are estimates pending verification** against the Azure Pricing Calculator for `northcentralus` and the first full billing cycle. They are modeled on the existing CBB cost profile (sourced from `Azure_Acquisition_Brief.md`), not on independent price lookups. Do not treat the dollar figures as exact — treat the *shape* (small incremental, reuse-heavy) as the decision basis.

---

## Incremental Resource Breakdown

| New resource | Billing model | Est. monthly | Basis |
|---|---|---|---|
| `ca-cbb-sign-api-prod` (Container App) | Consumption — vCPU-s + GiB-s + requests; **scales to zero** when idle | ~$0–4 | Same model as `ca-docuseal-prod` (~$0–5 in the existing profile). Internal tool, low traffic, idle most of the time. |
| `ca-cbb-sign-ui-prod` (Container App) | Consumption — scales to zero | ~$0–3 | Lighter than the API (static-ish Next.js serving). |
| `cbb_sign` PostgreSQL **database** | **$0 marginal** — new database on the **existing** `psql-cbb-prod` server | $0 | A second database on the same Flexible Server adds no compute/instance cost; only marginal storage within the existing 32 GB free-tier allotment. |
| `cbb-sign-certs` blob container (WORM) | Storage GB-month + write/read ops; immutable (time-based retention) | ~$0–1 | Completion certificates are small (PDF, ~tens–hundreds of KB each). At internal signing volume, well under $1/mo. WORM does not add a cost premium beyond stored bytes. |
| ACR image storage (API + UI + fork images) | Within existing **Basic ACR** ($5, already paid) | $0 marginal | `crcbbprod` Basic tier includes 10 GB; cbb-sign images fit within it. No tier upgrade needed. |
| Key Vault secrets (cbb-sign-scoped) | ~$0.03/10k ops | ~$0 | Rounds to zero at CBB scale (existing profile). |
| Managed certificates (`sign.*`, `sign-api.*`) | **$0** — Azure managed certs via CNAME validation | $0 | Same as DocuSeal's free managed cert. |
| DNS records (`sign`, `sign-api`, `asuid.*`) | Within existing Azure DNS zone | ~$0 | Negligible per-record/query cost in the existing zone. |
| Entra app registration + 3 groups | $0 | $0 | Entra ID object creation is not billed. |

**Net new recurring estimate: ~$2–8/month**, dominated by the two Container Apps' consumption when actually in use. When fully idle (no signing activity), the marginal cost approaches **~$0** because both Container Apps scale to zero and the database/storage additions are negligible.

**One-time costs:** none (no upfront/reserved purchases). Build effort is separate (see `OneDrive/CBB_Sign/03_-_Confidential/Infrastructure/CBB_Sign_LOE.md` — ~115.5h; that is labor, not Azure spend).

---

## What Is NOT a New Cost

These are explicitly reused, adding **$0** marginal infrastructure cost:

- **Container Apps Environment** `cae-cbb-prod` — already running (shared with DocuSeal + Gotenberg).
- **PostgreSQL server** `psql-cbb-prod` — already running; cbb-sign adds a database, not a server.
- **Container Registry** `crcbbprod` (Basic) — already paid; cbb-sign images fit the included quota.
- **Storage account** `stcbbprod` — already exists; cbb-sign adds a container.
- **Key Vault** `kv-cbb-shared-prod` — already exists; cbb-sign adds secrets.
- **VNet / subnet** `snet-ca-prod` — already provisioned.

**Cost reduction:** decommissioning the legacy DocuSeal→OneDrive Logic App (`logic-docuseal-onedrive-prod`, Consumption, ~$0.01–0.05/mo) at cutover **removes** a tiny recurring cost. Net effect is immaterial but directionally a saving, not just an add.

---

## Alternatives Considered (cheaper paths)

Per the cost directive, the cheaper alternatives were weighed:

| Alternative | Cost vs. chosen | Why not chosen |
|---|---|---|
| **Use DocuSeal's hosted SaaS** instead of self-hosting + wrapper | Higher recurring (per-seat/per-envelope SaaS pricing) + loses data custody | Defeats the entire purpose (CBB data custody, no third-party SaaS) and costs more at any real volume. Rejected. |
| **Single combined Container App** (API + UI in one) | Marginally cheaper (one app vs two) | Couples frontend/backend deploys, complicates scaling and the public/internal ingress split. The saving (~$0–3/mo) is not worth the architectural cost. Rejected. |
| **No WORM container — rely on append-only DB only** | ~$0–1/mo cheaper | Loses the independent, storage-enforced immutable evidentiary artifact (a core legal-record requirement, SPEC_audit.md §17). The cost saved is trivial; the guarantee lost is not. Rejected. |
| **Reuse an existing DB instead of a new `cbb_sign` database** | $0 difference (same server either way) | A separate database is cleaner (isolation, backup/restore scope, acquisition carve-out) at no extra cost. Chosen — it's free *and* better. |
| **Stand up a dedicated environment/server for cbb-sign** | Much higher (new CAE + new Postgres instance) | No benefit for an internal tool; violates the reuse principle. Rejected. |

The chosen design is already the near-minimum-cost option consistent with the requirements.

---

## Acquisition Lens

- cbb-sign costs are **attributable** via the existing `project`/`cost_center` tags — a buyer sees cbb-sign's spend separately from ScopeDOPE and corporate.
- The incremental cost is small and **consumption-based** (no reserved commitments to unwind), so a buyer who doesn't want cbb-sign can decommission it with no stranded spend.
- All resources are **infrastructure-as-code** (`cbb-infra/services/cbb/`) — no hand-built resources, consistent with the rest of the stack.

---

## Approval Gate

**Provisioning is BLOCKED until the owner approves the cost above.** On approval:

1. The number approved (and any cap) is recorded here.
2. Only then may `terraform apply` create cbb-sign resources.
3. Documentation (this analysis + Architecture Reference + Runbook + Rebuild Guide) precedes execution (CLAUDE.md "Documentation before execution").

| Field | Value |
|---|---|
| **Cost approved?** | ☑ **APPROVED** |
| **Approved figure / cap** | ~$2–8/month incremental (new CBB Azure total ~$27–38/mo first 12 mo → ~$39–53/mo after), as estimated in this analysis |
| **Approved by** | Jason Schwefel (owner) |
| **Date** | 2026-06-12 |

> Spend approved 2026-06-12. Provisioning of cbb-sign resources may proceed once the supporting documentation is complete (Architecture Reference, Operating Runbook, Rebuild Guide — all written) and per the standard release flow. **Note:** the WORM immutability policy must still not be *applied* until legal confirms the retention period (OI-C, deferred) — that gate is independent of this spend approval.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (`03_-_Confidential/`) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/CBB_Sign/CBB_Sign_Cost_Impact_Analysis.md` |
| **Cross-references** | `Azure_Acquisition_Brief.md` (cost baseline); `CBB_Sign_LOE.md` (build effort); cbb-sign `SPEC.md` §6 |
| **Created** | 2026-06-12 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| DRAFT | 2026-06-12 | Claude Code (Opus 4.8) | — | — | Initial cost-impact analysis. Incremental ~$2–8/mo (reuse-heavy; two consumption Container Apps dominate; DB/storage adds negligible). Alternatives weighed; chosen design is near-minimum-cost. Provisioning gated on owner approval. Figures modeled on existing CBB cost profile, pending pricing-calculator + first-billing-cycle verific