tegwick
3c33985113
Author the repository's INTENT: the infrastructure substrate — turning bare machines into hardened, verified, ready-to-build-on servers, declaratively and reproducibly, with the baseline proven good before anything builds on it. Kept self-coherent and reference-free: describes this repository's own purpose at the abstract, stable level, with no external project or dependency-product references. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
122 lines
3.2 KiB
Markdown
122 lines
3.2 KiB
Markdown
# INTENT
|
|
|
|
> This file captures **why this repository exists**,
|
|
> the **direction it is moving toward**, and
|
|
> the **kind of system it is meant to become**.
|
|
> It is intentionally **aspirational and stable**, not a description of current implementation.
|
|
|
|
---
|
|
|
|
## One-liner
|
|
|
|
**The infrastructure substrate — turning bare machines into hardened, verified, ready-to-build-on servers, declaratively and reproducibly.**
|
|
|
|
---
|
|
|
|
## Why This Exists
|
|
|
|
Everything else assumes servers that already exist, are hardened, and are
|
|
known-good. Without a disciplined foundation:
|
|
|
|
* server baselines drift,
|
|
* hardening is applied inconsistently,
|
|
* and higher layers inherit an unverified, untrustworthy substrate.
|
|
|
|
This layer exists to **provision and converge that substrate
|
|
reproducibly**, and to **prove it meets a security baseline** before
|
|
anything is built on top of it.
|
|
|
|
---
|
|
|
|
## The Mission
|
|
|
|
> *Where we are going.*
|
|
|
|
To become the **canonical, source-driven foundation** that provisions
|
|
servers, hardens and converges the operating system, manages bootstrap
|
|
secret material at rest, and validates the resulting baseline — so that
|
|
every higher layer can assume a **hardened, verified substrate**.
|
|
|
|
This means:
|
|
|
|
* The substrate is built **from source**, not hand-tuned on live hosts
|
|
* Security hardening is **part of provisioning**, not a later step
|
|
* The baseline is **tested and proven** before handoff
|
|
* The shape of the substrate is **recorded as the source of truth**
|
|
|
|
---
|
|
|
|
## Core Principles
|
|
|
|
### 1. Declarative and Reproducible
|
|
|
|
The substrate is derived from source and can be rebuilt the same way every
|
|
time. No irreproducible, hand-tuned hosts.
|
|
|
|
### 2. Hardened by Default
|
|
|
|
Security hardening is intrinsic to provisioning, not bolted on afterward.
|
|
|
|
### 3. Verified Before Handoff
|
|
|
|
The baseline is validated against an explicit specification and proven
|
|
good before any higher layer runs on it.
|
|
|
|
### 4. A Recorded Source of Truth
|
|
|
|
The inventory and shape of the substrate are recorded and authoritative,
|
|
not discovered after the fact.
|
|
|
|
### 5. Secure at Rest
|
|
|
|
Bootstrap secret material is encrypted at rest in source and never stored
|
|
in the clear.
|
|
|
|
### 6. Foundation, Not Tenant
|
|
|
|
This layer provides the ground. It does not run, orchestrate, or configure
|
|
the things built on top of it.
|
|
|
|
---
|
|
|
|
## What This Is (Conceptually)
|
|
|
|
This layer is:
|
|
|
|
* an **infrastructure substrate**
|
|
* a **provisioning and convergence** engine
|
|
* a **security hardening baseline**
|
|
* a **verification gate** before higher layers run
|
|
* a **recorded inventory** and source of truth for the substrate
|
|
|
|
---
|
|
|
|
## What This Is Not
|
|
|
|
This layer is not:
|
|
|
|
* the runtime or orchestrator built above it
|
|
* a provider of shared platform services
|
|
* an application or business-capability provider
|
|
* a place for higher-layer configuration
|
|
|
|
It is the **ground an entire landscape stands on**.
|
|
|
|
---
|
|
|
|
## Direction of Evolution
|
|
|
|
This layer is expected to evolve toward:
|
|
|
|
* Stronger **reproducibility** and drift detection
|
|
* Broader **provider** support without changing the model
|
|
* **Continuous** baseline verification
|
|
* Automated **rotation** of at-rest secret material
|
|
* Self-evidencing, **auditable** provisioning
|
|
|
|
---
|
|
|
|
## Guiding Question
|
|
|
|
> **How can the ground an entire landscape stands on be made reproducible, hardened, and provably good before anything is built on it?**
|