Lifecycle & operations
The Platform Architecture pages describe the shape of an estate, the cell it is built from, the topology cells spread across, and the edge as a first-class deployment. This section is the operational half: how a cell and a node move through their life, from a device that has never had a network, through joining a fabric, cloning a working environment, and recovering from the loss of a site.
Every operation here is designed to hold across the full deployment matrix, not a corner of it, single-cell and multi-cell, cloud-connected and air-gapped. Where an operation is genuinely narrower today than the matrix (a clean room is single-cell, for one), the page says so plainly rather than implying a reach it does not have.
What's covered
| Page | What you'll find |
|---|---|
| Initialization & setup | First boot of a cell from nothing: identity minting, profile bootstrap, phase-gated startup, and the offline path a cell (or an Edge Agent) takes when it has never had a network |
| Joining the fabric | Bringing capacity online: a new node in a new organization (mint the node, establish the trust root) versus a new node in an existing organization (enroll under the org CA, cell peering, attested reachability), and the identity chain at join |
| Cloning | Copy-on-write clone of a workspace or clean room: the eight planes that move together, the net-gain gate on a full deep clone, and the fail-closed checks a clean room's target must pass |
| Workspace mobility | The mobility plane as a whole: clone vs migrate vs failover, the home invariant, the cross-organization trust overlay, and the hash-chained provenance every move leaves |
| Migrating a workspace | The identity-preserving move runbook: move bytes, reconcile, fence, repoint, confirm, release, and fail back; in-org and cross-org |
| Workspace lifecycle operations | Delegate/succeed, rename+alias, promote (default → regular), snapshot/rollback, merge/split, quarantine, and archive/restore |
| Disaster recovery | Readiness, residency-aware standby election, and the failover and failback paths: recovery you have rehearsed, bounded by the residency constraint rather than the nearest spare |
| Releases & versioning | Why version skew across cells is normal, the expand / migrate / contract discipline that keeps new code safe against an older database, and the signed, ring-by-ring, rollback-able upgrade path |
The through-line
Four ideas connect every page here, and they are the same ones the rest of Platform Architecture returns to.
- A cell is a whole platform, so per-cell cost is real. Standing up, cloning, or recovering a cell is standing up a complete instance, not attaching a worker. Ephemeral cells launch roughly a hundred at a time, so a lifecycle operation's per-cell cost multiplies in the case that matters most, which is why setup is phase-gated and a full deep clone is gated on net gain rather than run freely.
- The node is the identity; the cell is replaceable. A node's identity survives cell replacement, so joining, rehoming, and recovery all operate under a node whose peers-facing identity does not change when the cell beneath it does.
- Nothing requires a round trip to decide. First boot, join authorization, clone application, and failover election all have a local, signed, offline path the deployment the product is sold on is sovereign and air-gapped, so an operation that needed a coordinator would fail exactly where it matters.
- A boundary that cannot be honored refuses. Residency is re-resolved live on every placement decision, so failover stays within the pinned level and an unsatisfiable required constraint refuses rather than degrading to the wrong jurisdiction. The lifecycle inherits that discipline: a clone that is not worth its cost, or a recovery target out of jurisdiction, is a recorded refusal, not a silent success.
Related topics
- The cell model, what one cell is, and how cells coordinate as peers.
- Deployment topology, the matrix and the region → zone → rack → cell hierarchy every lifecycle decision resolves against.
- Edge & fleet management, the transport ladder and fleet releases that carry these operations to a device in a hostile network.
- Replication, DR & federation, the convergence engine underneath cloning and disaster recovery.
- Data residency, the constraint that bounds where a clone or a failover may land.