C.W.K.
Stream
Lesson 04 of 04 · published

Earn the Right to Change Things

~10 min · read-only-first, mutation-disabled, agentless, least-privilege

Level 0Lone Machine
0 XP0/37 lessons0/12 achievements
0/100 XP to next level100 XP to go0% complete
"A control plane should be able to see everything and, on day one, change nothing."

Power off by default

Watchfire ships read-only, agentless, with production mutation disabled. It can inventory the fleet, probe reachability, read OS builds and service state and drift — and it cannot reboot, upgrade, enroll, or reconfigure anything. Full sight, zero touch. That is not a half-finished product; it's the intended starting posture.

Why start crippled on purpose

Because the two halves have wildly different risk. Observation is safe: run it, run it again, nothing downstream changes. Mutation is dangerous: it reboots a machine in another country, or retires the wrong host, or bricks an OS upgrade. So the safe half earns its keep on day one, and the dangerous half stays switched off until each specific operation has its preflight, approval rule, verification, and recovery story actually built and reviewed. Power arrives one gated operation at a time — never by flipping a single global switch to on.

Agentless first

The first probe path is a pull from the tower: reach eligible hosts over SSH, run bounded read-only commands, normalize the results. No daemon installed on nine machines. You add a resident agent only when a concrete operation genuinely cannot be made reliable without one — for example, work that must survive a reboot and the loss of SSH. Don't deploy a permanent agent to solve a problem you don't have yet; the agent is a cost you pay only when a real job demands it.

Manual evidence is not a receipt

Sometimes you fix a machine by hand — you sit down and upgrade it yourself. That's real and it counts as evidence. But it is not a signed executor receipt. The control plane records what it actually dispatched; it must never fabricate a receipt for work it merely watched happen. Keeping those two apart is what stops the logbook from slowly filling with comfortable fiction.

Observation is free; mutation is earned. Ship the seeing first, and let every capacity to change something arrive with its own gates attached.

Code

The posture, in config·bash
export WATCHFIRE_ENVIRONMENT=production
export WATCHFIRE_MUTATION_MODE=disabled   # look, don't touch

# Read paths work everywhere, all the time:
watchfire fleet status          # OK  -- observation
watchfire host show server       # OK  -- observation

# Mutating paths fail closed while disabled, checked at every boundary:
watchfire host restart server    # REFUSED -- mutation disabled; gates not built

# The power turns on per operation, after that operation's gates pass
# review. There is no single flag whose flip makes everything mutable.

External links

Exercise

Design the smallest read-only probe for your own machines: pick three or four bounded commands that answer 'is it okay?' without changing anything. Then name one thing you'd be tempted to 'just fix' inline during the probe — and argue why it should be a separate, reviewed operation instead.
Hint
Safe reads run twice with identical effect: an OS-version query, free-disk, uptime, a list of loaded services. Anything with remove, kill, install, or a settings write is not a probe — it's a mutation wearing a probe's clothes.

Progress

Progress is local-only — sign in to sync across devices.
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign inPlease sign in to comment.

No comments yet — be the first.