Watchfire Quest

Tracks

1. 01🗼The Watchtower

   0/4 lessons

   What a fleet control plane is, why it watches the machines themselves, and who holds the pen.

   Before any schema, the orientation. Watchfire is a fleet control plane — one host that keeps watch over a small group of Macs and holds the durable record of what they should be. This track frames the problem a control plane solves (machines drift, and a spreadsheet won't save you), draws the line between managing the machines themselves and the apps that run on them, explains why exactly one host holds the pen, and why a control plane earns the right to change anything by first proving it can only look.

   

   Lesson list (4)

   • 01
     Why a Watchtower~9 min · control-plane, fleet, drift, build-vs-rent
   • 02
     The Machines, Not Just the Apps~9 min · scope, machines-not-apps, observability, layers
   • 03
     One Host Holds the Pen~10 min · single-writer, authority, split-brain, source-of-truth
   • 04
     Earn the Right to Change Things~10 min · read-only-first, mutation-disabled, agentless, least-privilege

   ✓Quiz · 4 questions→

2. 02🎛️Two Kinds of State

   0/5 lessons

   Desired vs observed vs derived — why one boolean can never describe a fleet, and why a sleeping laptop isn't a problem.

   The heart of the whole engine. A fleet cannot be described by a single online flag, because the same flag means opposite things on an always-on server and a travel laptop. This track splits the question into two layers — desired state (policy: what a machine should be) and observed state (fact: what a probe saw) — computes a derived status from both plus freshness, reserves the color red for a genuinely violated expectation, and closes with the epistemics of evidence: some numbers are authoritative, some are only clues, and a missing number is unknown, never zero.

   Lesson list (5)

   • 01
     The One-Bit Lie~9 min · boolean-insufficient, health, policy
   • 02
     Desired State: The Promise~10 min · desired-state, policy, overrides, membership
   • 03
     Observed State: The Facts~9 min · observed-state, reachability, freshness, probe
   • 04
     Derived Status: The Verdict~10 min · derived-status, red-is-violated-expectation, membership-gates-health
   • 05
     Evidence Classes: Unknown Is Not Zero~10 min · evidence-classes, unknown-not-zero, epistemics, correlation

   ✓Quiz · 5 questions→

3. 03🪪Membership Is a Decision

   0/5 lessons

   The registry is identity, the tailnet is not the fleet, and 'remove' means retire — a tombstone, never a delete.

   A fleet is the set of machines you chose to manage, recorded explicitly — not whatever answers a ping. This track makes identity a thing you assign (a stable host_id anchored to hardware evidence, with hostnames and IPs demoted to mutable observations), separates the tailnet from the fleet (the network is full of devices that are not yours to manage), walks the enroll → suspend → retire → restore lifecycle as typed operations, insists that removal is a tombstone rather than an erase, and treats the starting count as seed inventory, never a schema limit.

   Lesson list (5)

   • 01
     The Registry Is Identity~10 min · registry-is-identity, stable-id, binding-evidence
   • 02
     The Network Is Not the Fleet~9 min · tailnet-is-not-the-fleet, classification, discovery
   • 03
     The Lifecycle~10 min · lifecycle, enrollment, suspend, typed-operations
   • 04
     Retire, Never Delete~10 min · retire-not-delete, tombstone, purge, append-only
   • 05
     Nine Is Seed, Not Cardinality~9 min · seed-not-cardinality, dynamic-membership, replace, magic-numbers

   ✓Quiz · 5 questions→

4. 04⚙️Durable Operations

   0/5 lessons

   Every change is a durable operation with a frozen target, a preflight, and a recovery — and the chat turn is never the state store.

   A button click that runs and hopes is a wish, not an operation. This track makes every mutation a durable record with a state machine (draft → planned → awaiting_approval → running → verifying → succeeded | failed | needs_attention | cancelled), freezes the target set at approval so a changing selector can't expand the work, lets targets progress independently so seven successes and one sleeping host stay three honest outcomes rather than one ambiguous failure, keeps operation state out of the chat turn entirely, and closes with the per-host locks and idempotency keys that make retries safe.

   Lesson list (5)

   • 01
     Every Change Is an Operation~10 min · durable-operation, state-machine, needs-attention
   • 02
     Freeze What You Approved~10 min · frozen-snapshot, approval, preflight, blast-radius
   • 03
     Targets Progress Independently~9 min · independent-targets, partial-outcomes, isolation
   • 04
     The Chat Turn Is Not the Store~9 min · chat-is-not-the-store, delegation-by-id, single-source-of-truth
   • 05
     Locks and Idempotency~10 min · locks, idempotency, retries, verify-separately

   ✓Quiz · 5 questions→

5. 05🧱Typed, Not Shell Fan-out

   0/5 lessons

   No durable API takes a blank-check shell string. Risk classes, a visible escape hatch, and propose-don't-run instead.

   The most dangerous thing a fleet tool can offer is 'run this command everywhere.' This track refuses to let an arbitrary shell string be a durable automation contract, sorts every action into risk classes with matching postures, keeps the interactive terminal as an explicit and visibly targeted escape hatch rather than a disguised automation path, holds the line that a proposed command is inserted but never auto-run, and freezes each operation's kind and risk so it can't quietly escalate — validated at definition, claim, and start, failing closed on any mismatch.

   Lesson list (5)

   • 01
     No Blank-Check Shell~10 min · no-blank-check, typed-kinds, fan-out
   • 02
     Risk Classes~9 min · risk-classes, proportional-gating, approval-fatigue
   • 03
     The Escape Hatch~9 min · escape-hatch, interactive, visible-target
   • 04
     Propose, Don't Run~10 min · propose-dont-run, insert-is-not-run, stale-context
   • 05
     Freeze the Operation's Shape~9 min · frozen-kind, fail-closed, domain-bound, boundaries

   ✓Quiz · 5 questions→

6. 06🔑Execution Envelopes

   0/4 lessons

   The same Mac is many doors. Which capabilities you get depends on how you knocked — and reachable is never the same as allowed.

   The most under-appreciated fact in fleet work: a machine is not one capability surface. This track shows that the same Mac exposes different powers through an interactive login, an SSH session, a launchd daemon, or a delegated agent; tells the real war story of an SSH session that could push to GitHub but couldn't read the login Keychain gh needed; makes every executor declare its capabilities and every step declare its requirements so preflight can match them; and hammers the line that reachability is not authorization — headless work never assumes GUI, Keychain, or volume-owner access.

   Lesson list (4)

   • 01
     One Mac, Many Doors~9 min · execution-envelope, capabilities, keychain, launchd
   • 02
     The Keychain Story~9 min · keychain, wrong-fix, war-story, identity-not-credential
   • 03
     Declare and Match~9 min · declare-and-match, preflight, capabilities
   • 04
     Reachable Is Not Allowed~9 min · reachable-is-not-allowed, volume-owner, no-fabricated-credentials

   ✓Quiz · 4 questions→

7. 07🚀Pan-Fleet Campaigns

   0/5 lessons

   Co-author, compile, freeze, execute, template. Speed-first and resumable — a sleeping Mac never fails the campaign.

   Some fleet work is too big and too new to just do — upgrade every machine's OS, migrate a root path the whole system depends on. This track builds those campaigns the safe way: co-authored as a conversation, compiled and frozen like a plan, run speed-first with independent targets in parallel, and resumable per target so a sleeping Mac is pending work rather than a failure. It closes with two real campaigns — a fleet-wide OS upgrade and a root-path migration — each teaching a durable lesson about doing dangerous, irreversible work without losing your nerve or your evidence.

   Lesson list (5)

   • 01
     Co-Author, Then Compile~10 min · co-author, plan-compiler, templates, delegation
   • 02
     Speed-First, Serialize for a Reason~9 min · speed-first, parallel, office-last, no-theater
   • 03
     Resumable per Target~9 min · resumable, sleeping-is-not-failure, systemic-vs-isolated, no-fake-rollback
   • 04
     War Story: The Fleet OS Upgrade~10 min · tahoe, frozen-build, core-gate, reboot-survivable
   • 05
     War Story: The Root Migration~10 min · root-migration, remake-not-remaster, fail-closed, writer-fencing

   ✓Quiz · 5 questions→

8. 08🤝Assist, Don't Absorb

   0/4 lessons

   The engine records and executes; the brain judges. Read before you claim, keep mutation deliberate, and own the way you run your machines.

   The closing track draws the line the whole engine is built around. Watchfire owns fleet facts and operation state; cwkPippa owns identity and judgment — and each consumes the other's contract without absorbing its internals. The Sidekick pulls current state by a stable id and reads fresh before making any claim, never caching a fleet snapshot into a chat turn. Mutation stays a deliberate, gated posture rather than a default. And it ends where it began: Pippa is the brain, Watchfire is the eyes and hands, and the whole point was always to own the way you run your own machines.

   Lesson list (4)

   • 01
     The Boundary~9 min · boundary, consume-not-absorb, separation-of-concerns
   • 02
     Pull, Don't Push~9 min · pull-model, read-before-claim, sidekick, freshness
   • 03
     Mutation Stays Deliberate~9 min · mutation-disabled, automation-boundary, earned-power, no-fake-receipt
   • 04
     Own the Way You Run Your Machines~10 min · self-referential, own-your-machines, conceptual-opensourcing, capstone

   ✓Quiz · 4 questions→