substrate

What a mitigation pack has to prove before it runs

28 October 2026 · security ansible supply-chain mitigation substrate

Seven of our remediation roles are public, with the shared library they depend on. The fixes themselves are a morning's work each. What took the time was deciding what a pack must declare and demonstrate before anything will run it as root across a fleet, and only some of those gates exist today.

Zero to ping, and the decade of doing it by hand

28 August 2025 · infrastructure operations deployment substrate ansible

We have photographs of engineers doing by hand, for nine years, the jobs a control plane now does: network boot, on-site backup, remote access built out of Raspberry Pis, a hundred laptops in a fortnight. The pattern in those photographs is the whole argument.