Scale
One machine to a full datacentre
Six tiers, each additive. Contexts name environments, zones name placement, platforms do the work — growing a deployment is declaring more of each. It is never a different tool.
1 A single machine
Everything on one workstation under libvirt/KVM: deterministic per-VM addresses, wildcard local DNS, full lifecycle from a cold start. This is not a toy tier — it's the design's floor, and every feature must work here first.
2 A home lab
One Proxmox node over the API. The same machine declarations that built on the workstation build on the cluster — the platform is chosen per environment, never baked into the project.
3 An office
The physical fabric appears: a managed switch, a declarative firewall, VLAN segmentation, Wi-Fi. The switch fabric becomes observable and appliable, with a connectivity-cutoff gate standing between the operator and a self-inflicted outage.
4 An edge site
Hypervisors reached over IPsec and bastion chains. Resident agents hold outbound connections so machines behind NAT stay live in the fleet view with zero inbound ports — and PXE boot has been proven across sites, through the tunnel.
5 A research lab
Many short-lived VMs, built and destroyed continuously. Sagas unwind failed multi-step builds; retention policies and a fail-safe reaper keep ephemeral fleets from decaying into orphans. Unknown age never reaps.
6 A datacentre
Multiple hypervisor nodes plus bare metal onboarded over standard Redfish across heterogeneous vendors — Dell iDRAC, HPE iLO — with PXE provisioning, BIOS profiles, firmware inventory and per-node capacity accounting, over-provisioning shown honestly rather than clamped.
Evidence from real iron
Each tier's claims gate on live hardware before they ship.
Bare metal, enumerated
A Dell PowerEdge R740's iDRAC9 probed to power and health state, 376 BIOS attributes, 4 storage controllers and 26 firmware components; an HPE ProLiant MicroServer Gen8 onboarded through iLO4's documented quirks.
Unattended installs, timed
A stock hypervisor ISO baked with an answer file boots to a configured, fleet-keyed node in roughly three minutes — power on and walk away. The PXE path has passed its live gate end-to-end, headless.
A multi-site estate, daily
The platform's own fleet spans datacentre, office, lab and edge sites over an IPsec mesh — the same declarations, reach graph and drift detection operating all of them from one control plane.
The seventh tier isn't hardware
Every tier above buys the same thing: a floor you own for software that never clocks off. The destination workload is the autonomous software factory — goals set by day, agents building through the night, gates watched by the platform. Steady, always-on load: exactly what owned iron amortises best.
Micro‑Substrate is the floor of that story. The workforce that runs on it is the layer above — and the whole factory, floor to workforce, is told on the platform site.
Start at tier one today
The laptop tier is the whole platform. If it earns its place there, growing it is just more declarations.