Control-plane architecture

Enclavr separates authority, policy, planning, and operating-system mutation. That boundary is what makes a value-free plan possible and keeps adapters from becoming independent configuration engines.

Open the control-plane architecture full size

Layer 1: authoritative state

OpenBao is the normal source of truth for complete namespace documents. A protected, host-specific connection pins the namespace, cluster identity, TLS trust, explicit endpoints, AppRole identity, and readable item set.

Standalone pre-Go bootstrap uses an accepted OpenBao connection and hands control to Go as soon as the repository is available. Each voter starts with its existing pinned seal in minimal config/seal.json. Recovery shares and CA signing keys stay in the operator's protected custody; they are never distributed to ordinary consumers or obtained through an external secret-store login.

Layer 2: Go control plane

The repository-root Go module:

• accepts OpenBao as the sole provider;
• reads and materializes complete documents;
• rejects duplicate JSON keys and validates the embedded schema;
• normalizes platform and host-template configuration;
• selects the exact current host;
• applies feature policy and ordering;
• resolves only the protected inputs required by the action being executed;
• creates complete action envelopes and verifies outcomes.

The CLI and Bubble Tea TUI share the same application services and action catalog. They do not maintain parallel deployment logic.

Layer 3: action plan

enclavr host plan is read-only and value-free. It identifies what would run and in what order, but it does not resolve secret-bearing templates. enclavr host deploy revalidates the source, resolves the selected action inputs in memory, and executes only the reviewed current-host plan.

Layer 4: mutation adapters

Bash adapters are narrow operating-system boundaries. They receive complete action input over protected standard input or protected files. They may inspect observed host state and perform the requested mutation, but they may not reinterpret assets, choose defaults, evaluate feature flags, or establish another source of truth.

Layer 5: observed state and verification

Every mutating action must converge:

• an already-correct host is a successful no-op;
• changed input reconciles only the affected component;
• a retry after partial failure resumes toward the declared state;
• databases, volumes, identities, and protected material are preserved;
• real validation, conflict, health, and verification failures remain visible.

Verification proceeds from control-plane result to managed-host state to the real consumer path. A local process or container healthcheck is only one part of that chain.

Trust rules

• An omitted or blank provider selects OpenBao; any other provider is rejected. OpenBao failure never causes fallback.
• Ambient VAULT_*, BAO_*, proxy, personal 1Password, and competing service-account credentials do not redirect the accepted OpenBao connection.
• Protected values are not allowed in command arguments, plans, logs, or diagnostics.
• A read-only runtime identity cannot silently become a namespace writer.
• Existing assets are never reconstructed from a partial projection.

Continue with Namespace model or Secret-store boundaries.