railiance-hosts/INTENT.md

INTENT

This file captures why this repository exists, the direction it is moving toward, and the kind of system it is meant to become. It is intentionally aspirational and stable, not a description of current implementation.

---

⚠ SUPERSEDED — do not start new work here.

This repository is superseded by railiance-infra, which is the canonical S1 Infrastructure Substrate home. Verified 2026-08-11: the two are distinct remotes with unrelated git histories, and at that date the INTENT.md files were byte-identical. railiance-hosts had zero files that are not also in railiance-infra. This repo has been quiet since 2026-07-30 while railiance-infra continued. The ownership claim now lives only in railiance-infra.

It was one of four repos (bootstrap, cluster, hosts, infra) created by copying working trees as the S1/S2 layering idea emerged — the INTENT was copied along with everything else, which is why this file reads as though this repo is the canonical substrate home. It is not.

Retirement is pending in railiance-master. Before deletion, two things must happen: its git history must be checked for anything not carried into railiance-infra, and its live State Hub goal "Secure Single-Server Bootstrap at HostEurope" must be moved to railiance-infra or it will keep resurfacing as unstarted S1 work.

Context: railiance-platform/ArchitectureBlueprint.md section 4.

Boundary in force. railiance-infra is the only S1 substrate owner. This repository owns no provisioning, hardening, inventory, or baseline responsibility. The sections below are the copied text that caused the overlap. They are not a second claim.

---

One-liner

The infrastructure substrate — turning bare machines into hardened, verified, ready-to-build-on servers, declaratively and reproducibly.

---

Why This Exists

Everything else assumes servers that already exist, are hardened, and are known-good. Without a disciplined foundation:

• server baselines drift,
• hardening is applied inconsistently,
• and higher layers inherit an unverified, untrustworthy substrate.

This layer exists to provision and converge that substrate reproducibly, and to prove it meets a security baseline before anything is built on top of it.

---

The Mission

Where we are going.

To become the canonical, source-driven foundation that provisions servers, hardens and converges the operating system, manages bootstrap secret material at rest, and validates the resulting baseline — so that every higher layer can assume a hardened, verified substrate.

This means:

• The substrate is built from source, not hand-tuned on live hosts
• Security hardening is part of provisioning, not a later step
• The baseline is tested and proven before handoff
• The shape of the substrate is recorded as the source of truth

---

Core Principles

1. Declarative and Reproducible

The substrate is derived from source and can be rebuilt the same way every time. No irreproducible, hand-tuned hosts.

2. Hardened by Default

Security hardening is intrinsic to provisioning, not bolted on afterward.

3. Verified Before Handoff

The baseline is validated against an explicit specification and proven good before any higher layer runs on it.

4. A Recorded Source of Truth

The inventory and shape of the substrate are recorded and authoritative, not discovered after the fact.

5. Secure at Rest

Bootstrap secret material is encrypted at rest in source and never stored in the clear.

6. Foundation, Not Tenant

This layer provides the ground. It does not run, orchestrate, or configure the things built on top of it.

---

What This Is (Conceptually)

This layer is:

• an infrastructure substrate
• a provisioning and convergence engine
• a security hardening baseline
• a verification gate before higher layers run
• a recorded inventory and source of truth for the substrate

---

What This Is Not

This layer is not:

• the runtime or orchestrator built above it
• a provider of shared platform services
• an application or business-capability provider
• a place for higher-layer configuration

It is the ground an entire landscape stands on.

---

Direction of Evolution

This layer is expected to evolve toward:

• Stronger reproducibility and drift detection
• Broader provider support without changing the model
• Continuous baseline verification
• Automated rotation of at-rest secret material
• Self-evidencing, auditable provisioning

---

Guiding Question

How can the ground an entire landscape stands on be made reproducible, hardened, and provably good before anything is built on it?