"A control plane should be able to see everything and, on day one, change nothing."
Power off by default
Watchfire ships read-only, agentless, with production mutation disabled. It can inventory the fleet, probe reachability, read OS builds and service state and drift — and it cannot reboot, upgrade, enroll, or reconfigure anything. Full sight, zero touch. That is not a half-finished product; it's the intended starting posture.
Why start crippled on purpose
Because the two halves have wildly different risk. Observation is safe: run it, run it again, nothing downstream changes. Mutation is dangerous: it reboots a machine in another country, or retires the wrong host, or bricks an OS upgrade. So the safe half earns its keep on day one, and the dangerous half stays switched off until each specific operation has its preflight, approval rule, verification, and recovery story actually built and reviewed. Power arrives one gated operation at a time — never by flipping a single global switch to on.
Agentless first
The first probe path is a pull from the tower: reach eligible hosts over SSH, run bounded read-only commands, normalize the results. No daemon installed on nine machines. You add a resident agent only when a concrete operation genuinely cannot be made reliable without one — for example, work that must survive a reboot and the loss of SSH. Don't deploy a permanent agent to solve a problem you don't have yet; the agent is a cost you pay only when a real job demands it.
Manual evidence is not a receipt
Sometimes you fix a machine by hand — you sit down and upgrade it yourself. That's real and it counts as evidence. But it is not a signed executor receipt. The control plane records what it actually dispatched; it must never fabricate a receipt for work it merely watched happen. Keeping those two apart is what stops the logbook from slowly filling with comfortable fiction.