A control plane that only ever tells you what your server actually did.

Desired state goes out whole. An agent on each box converges and reports back. Nothing on this panel is written by the panel about itself.

• Blue and green releases, a health gate before every cutover, rollback that is a pin.
• Secrets sealed to the server’s own key. This panel can write one and can never read it back.
• Typed intents on the wire, never a shell. A stolen database is not a root shell on your box.