One ecosystem. Separate responsibilities.
| Component | Owns |
|---|---|
| ComputeAPI | Provider adapters, capacity discovery, provisioning, and commercial capacity models. |
| SystemAPI | Host identity, control-plane operations, agent communication, telemetry, and script execution. |
| adssh | The execution shell, shell policy, approvals, and execution evidence. |
| vpscfgfarm | Contracted fleet changes, governor enforcement, and sanctioned execution paths. |
| badfarm / goodfarm | Read-only discovery and evidence; reviewed repair coordination and independent verification. |
| SAH utilities | Local discovery, HTTP access, shell launch, and process I/O capture. |
The intended lifecycle
Automatic ComputeAPI-to-SystemAPI enrollment and SystemAPI-to-adssh lease handoff are not implemented. The initial sah/1 frame does not connect those steps.
Execution and authority
The SystemAPI agent and adssh remain separate programs. SystemAPI uses its outbound agent for entitled workload operations. adssh supplies shell execution and policy; break-glass integration stays a child-process boundary.
vpscfgfarm owns its governor and contracted mutation path. goodfarm coordinates approved protocol requests rather than inventing commands from findings. farmops is designed to propose and schedule work under that existing authority.
Identity is not interchangeable.
SystemAPI hosts device login. adssh is a client of that flow. Dashboard login uses Authentik. The opaque CLI bearer, a dashboard access token, a local sahapi bearer, and a provider API key serve different purposes.
sahapi does not host OAuth. Its server-side SystemAPI key is separate from the bearer presented by a local caller.
Bare metal needs a lifecycle.
The planned offering combines capacity allocation with enrollment, policy-controlled operations, and cleanup. Physical power control and imaging require a provisioning adapter in addition to a reachable execution shell. Dedicated hosts and shared container capacity will need separate isolation and allocation contracts.
Domain map
| Domain | Purpose |
|---|---|
| opensah.com | Public ecosystem and tool directory. |
| opensah.io | Platform architecture and product direction. |
| opensah.dev | Installation, reference, and availability documentation. |
| sah.sh | Shell and operator-tool entry point. |
| systemapi.io | Fleet management and execution control plane. |
| computeapi.io | Capacity catalog and infrastructure offering. |
Domain names do not rename Go modules, repositories, or the adssh executable.