Skip to content
Harobanda

Solution first

The solution comes first. The machine is derived from it.

You do not bend your solution to fit the OS. You write down what your solution must guarantee — a fixed address the devices can find, a log that survives a power cut, a data store that never leaves the building, a clean restart after the mains drop — and the machine is derived from that sheet. It does exactly one job, and it can prove it does.

A machine is one text file. Each line is a plain fact: which computer it is, which disks it uses and in which folder each one appears, which programs it keeps running, and what each of them is allowed to touch. There is no configuration to discover later and no hidden state to reverse-engineer — the machine is its file.

Two panels that differ in what sits at the top. On the left a general-purpose operating system built for everyone, in which your job is one small part; you adapt and subtract, and the panel below shows two things crossed out while the rest is still there. On the right a sheet of what the job must guarantee — a fixed address, a name that never moves, a record that survives, a clean restart — and below it, derived from that sheet, a machine containing exactly those four and nothing more Two panels that differ in what sits at the top. On the left a general-purpose operating system built for everyone, in which your job is one small part; you adapt and subtract, and the panel below shows two things crossed out while the rest is still there. On the right a sheet of what the job must guarantee — a fixed address, a name that never moves, a record that survives, a clean restart — and below it, derived from that sheet, a machine containing exactly those four and nothing more

An example

A temperature sensor in a cold room, running on a general-purpose Linux, still needs kernel updates, a package manager, remote-login hardening and service configuration — none of which have anything to do with measuring temperature. Each is a door for a problem and a job for someone who is not there. A declared machine has none of it, because none of it was declared. The sensor's job is the whole of the machine.

A general-purpose OS

  • Built for everyone, adapted by you to one job
  • Ships with far more than your solution needs
  • Configured by hand; the config drifts over time
  • You hope it behaves; you cannot prove it will

A declared machine

  • Built for one job, derived from what that job needs
  • Contains only what was declared, nothing more
  • Is its file; a change is a new file, judged again
  • Proves its boot against its own declaration, every time