The Platform
From a powered-off box to a running stack
Everything between bare metal and your workloads, as one system: declare it in Git, and the platform builds, runs and watches it.
One core. Every surface. Two privilege tiers.
A single API core serves the browser UI, the JSON API and the MCP server; the micro CLI is a thin client of the same API. All four resolve to the same principal, pass the same RBAC gate, and land in the same audit log.
The API can't hurt you
The web-facing process holds no Docker socket, no hypervisor connection, no Ansible, no SSH keys — and cannot write to the job queue. It reads everything and touches nothing. Compromising the most-exposed process buys an attacker nothing the operator hadn't already granted.
The runner rebuilds every command
Mutations queue over a Unix socket to a separate privileged worker, which looks the job up in a typed registry and reconstructs the command line itself — the same shape as parameterised SQL. A forged or tampered job doesn't fail; it is refused, visibly.
Jobs, sagas and undo
Every mutation is a job with a live-streamed log and a terminal state. Multi-step operations are sagas: when step four fails, the completed steps' undo actions run in reverse and the job lands unwound — not half-applied.
Unattended operation
Cron schedules initiate work, notifications report it, webhooks react to it — each through the same job registry and audit trail. A webhook can only trigger the one pre-declared job it was built for; payloads never choose what runs.
Git is the source of truth — not a database, not the infrastructure
Every project declares its machines, networks and firewalls in its own repository. The control plane walks all of them together, joins declaration against live observation from hypervisors, SSH probes, resident agents and BMCs, and badges every row: managed, declared‑only, or unmanaged.
There is no continuous auto-reconcile loop — a deliberate departure from Kubernetes-style controllers. The platform makes drift loud and convergence deliberate: it shows you the gap, and closes it only when you or an agent runs the job.
Machines carry stable 26-character identities that survive rename, rebuild and migration. Names are labels; identity is forever — so history, metrics and audit never orphan.
machines:
- id: lv01k3ta9x7m2qwzr8cjy4bnfd
name: cargo01
size: medium # 4c / 8G / 40G + 100G data
roles: [cargo-server]
zone: dc01-prod # placement, not a hostname
networks:
- vlan: 30
proxy_jump: bastion01 # reach: via, not directBare metal and hypervisors to Docker-ready hosts
The substrate layer provisions the machine and stops at the container boundary. A role's prefix tells you where it runs: os.* inside a freshly booted guest, infra.* against the platform that hosts it, net.* and fw.* against the fabric around it.
Platforms
libvirt/KVM and Proxmox VE are live today, from a single platform‑agnostic machine spec — the same declaration builds on a workstation or a cluster. Cloud targets are on the roadmap.
Idempotency as a contract
Re-provisioning an unchanged host shows changed=0. Destroying an already-gone VM is a pass, by design. Deterministic MACs and IPs mean a rebuilt VM keeps its address.
Access as an audit trail
One allow/revoke directory of SSH keys drives cloud-init, steady state and hypervisor sync. The Git log of that directory is the access review — mapped to ISO 27001 controls.
The layer most control planes are blind to
Honest reachability
Every deployment carries a reach state: direct, via <bastion>, stranded, unreachable or unknown. Destroying a bastion pops a typed-name confirm naming every machine it would strand. Builds pre-flight their dependency chain before firing.
The change that can cut you off
Host bonds and uplink bridges apply behind a confirmed-apply with auto-revert — and the revert timer runs on the node itself, so it fires even when the change severs the control plane's own path in.
Switch fabric, managed
Pluggable drivers observe and apply VLAN state on Dell OS10 and UniFi fabrics. A connectivity-cutoff gate computes who gets stranded before any removal, degrades conservatively on incomplete data, and hard-refuses touching the switch's own uplink.
The graph is the documentation
A drag-to-edit topology map spans physical cabling, VLANs, hypervisors, VMs and bastion chains. Click a VM and its declared path lights up, wire by wire. Edits mutate declarations — staged as reviewed commits, never live-state pokes.
One declarative schema, three firewall platforms
WAN address space, VLAN interfaces, split-horizon DNS, DHCP reservations, rules and NAT — declared once, rendered to pfSense, OPNsense or OpenWrt by flipping a single key. Rules reference symbols, not literals: renumbering a service is a one-line edit, not twenty-three rule rewrites.
- Renderers start from captured real-appliance configurations, and a contract test renders one canonical spec through all three platforms to prove semantic equivalence.
- Declared-vs-live drift detection canonicalises both sides before diffing — and anything the importer doesn't model reports not compared, never “clean”.
- Where a platform can't honour the schema, it says so: unsupported shapes fail fast with a clear error rather than rendering guessed configuration an appliance may silently reject.
One command, one coffee
A bare box on the bench becomes a managed hypervisor: micro metal provision boots it over PXE from an ephemeral boot service, drives an unattended install, and onboards the result into the fleet.
spore
The PXE boot service is a TTL'd job, not a permanent daemon — proxy-DHCP, TFTP and HTTP that exist only while a machine is being colonised. Spores are how fungi reach new substrate; the name is not an accident.
Standard Redfish, vendor-aware
Power, virtual media, boot order, BIOS profiles, RAID and firmware — over the Redfish standard across Dell iDRAC, HPE iLO and Supermicro, with named, reviewed profiles instead of a brickable free-form editor.
Live-gated on real iron
Features gate on real hardware before they ship — a Dell R740's iDRAC enumerating 376 BIOS attributes and 26 firmware components; an HPE MicroServer's iLO4 with its documented quirks. Async BMC operations settle by polling to the target state, never by sleeping and hoping.
From declaration to a running stack
micro-glue renders environment YAML into complete Docker Compose stacks — Traefik ingress and TLS, databases, message queues, observability, backup agents and forty-nine templated services, each described by machine-readable metadata the control plane's catalogue, wizards and rules-lint consume.
Compile on the substrate, ship a bundle
Stacks compile on the control plane into a checksummed bundle; images pull from the platform's own token-authenticated registry. What lands on a customer-accessible VM is only the rendered result — no templates, no tooling, nothing proprietary.
It hosts itself
The control plane is deployed as a stack it rendered, on a VM it provisioned, and can redeploy itself with one command. Dogfooding is the fastest way to find where the platform's promises break — so it depends on all of them.
Watch everything. Rebuild from a laptop.
Medusa
A federated Prometheus architecture with Grafana, Loki, Tempo and Alertmanager — central dashboards over leaf servers, pre-built alert catalogues, Slack-native routing, and a daily backup-verification report that treats an unverified backup as a failure, not a hope.
The nuke drill
The platform's north-star test: we lost the datacentre; the operator has a laptop. Every feature is judged by whether it shortens the path from bare metal to fleet-green with data restored — and the drill is run for real, against real machines, with the timing as the KPI.
What it replaces
One coherent system where operators otherwise run four disconnected tools — tailored to a team running its own fleet of projects: private cloud, lab, MSP or internal platform scale.
| Capability | Commonly assembled from | In Micro-Substrate |
|---|---|---|
| VM lifecycle | Proxmox VE / vCenter consoles | Declared machines, audited lifecycle jobs |
| Bare-metal provisioning | MAAS, vendor tooling | spore PXE + Redfish, one command |
| Source of truth | NetBox, wikis, tribal knowledge | YAML in Git, joined live against reality |
| Job execution & audit | AWX / Rundeck / Semaphore | Typed job registry, sagas, one audit log |
| Operator portal | Backstage / Port | Operator-shaped UI over the same core |
Micro-Substrate converged independently on the same thesis as Oxide's rack-scale control plane — declared state, one API/UI/CLI surface over compute, network, storage and bare metal — with the opposite integration bet: heterogeneous gear you already own, rather than vertically integrated hardware.
What it is not
The same honesty the platform applies to fleet state applies to its own claims.
- A single-operator trust model — roles gate capability, not tenancy. It is not multi-tenant SaaS.
- No high-availability control plane — if the management surface dies, provisioned workloads keep running and the surface redeploys with one command.
- No silent convergence — drift is surfaced, remediation is always an explicit, audited act.
- Cloud targets aren't shipped yet — AWS and Azure are on the roadmap, and they'll plug in behind the same platform seam.
See it against your estate
A technical briefing walks your topology, your hardware and your constraints through the platform — engineers on both ends of the call.