operate
how the machines, domains, keys and sites of the state keep running, stay observed and come back after a failure. the record is cybernode: the server is the truth, the repository mirrors it, and the sync is the first and last step of every change.
trigger: a change that must reach a machine; an alarm; a certificate, a domain or a key nearing its end; a runbook that proved wrong.
the graph
| node | role | makes | green when |
|---|---|---|---|
| 1 plan · worker | runner | the change as a runbook step: command, expected state, rollback | the rollback is written before the command |
| 2 stage · worker | runner | the change on a staging path or a backup first | a test passes where one exists: nginx -t, a probe, a dry run |
| 3 apply · gate | runner; the owner on the irreversible lane | the change on the machine | the probe from outside answers as expected |
| 4 observe · code node | sensor | monitors, logs, alarms; the machine's row in apparatus/estate.toml and its live line on the estate board |
the alarm that would have caught this failure exists |
| 5 mirror · code node | keeper | the repository matches the machine; the runbook carries what was learned | sync.sh shows no drift |
apply: local probes are evidence, never the verdict.
return edges
- short: a probe that fails returns to stage with the evidence; the rollback runs first.
- long: every incident leaves a line in the runbook and, where it can, a monitor; a procedure that failed twice is rewritten, not annotated.
lanes
contained: a static site's docroot, a monitor, a DNS record that has a backup of the zone. wide: nginx, certificates, cron, anything shared by several sites. irreversible: deletion of data, a key, a payment, a change to the production chain; the owner's hand, always.
pages
the runbooks and mirrors in cybernode; incidents as tasks of kind issue; what was learned on the runbook, dated.