Recognize declared service state in the rebuildability principle #47

New issue

Open

opened 2026-09-04 01:00:03 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-09-04 01:00:03 +01:00

Contributor

Problem

Architecture principle 9 says the backup-worthy set is exactly the forge and encrypted key material. That wording does not generalize to additional stateful services whose durable data cannot be reconstructed from a clone.

Proposed update

9. Machines rebuild from a clone; durable state is explicit.

A machine is a pure function of framework plus inventory plus secrets: disk layout, system, home, and workspace all regenerate from the forge. Machines are disposable and destructively replaceable, never repaired by hand. The backup-worthy set is encrypted key material plus explicitly declared service state that cannot be derived from a repository, including the forge itself; every stateful service owns a tested backup and restore path for that state. Resilience comes from rapid reconstruction and recovery: rebuild the machine, restore its declared state, and reconnect its clients. Add machinery that preserves live continuity only when measured recovery requirements justify it.

## Problem Architecture principle 9 says the backup-worthy set is exactly the forge and encrypted key material. That wording does not generalize to additional stateful services whose durable data cannot be reconstructed from a clone. ## Proposed update **9. Machines rebuild from a clone; durable state is explicit.** A machine is a pure function of framework plus inventory plus secrets: disk layout, system, home, and workspace all regenerate from the forge. Machines are disposable and destructively replaceable, never repaired by hand. The backup-worthy set is encrypted key material plus explicitly declared service state that cannot be derived from a repository, including the forge itself; every stateful service owns a tested backup and restore path for that state. Resilience comes from rapid reconstruction and recovery: rebuild the machine, restore its declared state, and reconnect its clients. Add machinery that preserves live continuity only when measured recovery requirements justify it.