Nothing critical runs on a laptop that travels

date: 20260722 to 20260917
what happened: Node0 began as one laptop doing everything, and the first agents ran on laptops that left the building. Over the summer every service the site depends on moved onto hardware that stays: the agents onto racked machines, then the operating agent into a guest inside the fabric on 20260917; DNS, time and backups onto boxes that never travel. The laptops that still carry a role (agent1, agent2, dev1, dev2, the two serving laptops) are racked permanently and are hosts in every sense except their shape.
what it cost: Nothing, because the rule was set before it was broken: a design decision rather than an incident. The near misses that argue for it are on their own pages (4.17, a VPN client on a laptop that captured the site's routes; 6.15, an agent memory migrated off a laptop to a path the session never read).
what changed: A standing rule for Node0 and for the seed: no critical service runs on a laptop that travels, and no secret lives on one outside a secured vault, the password manager or the site's own vault, reached with a credential that can be revoked from the site. A laptop racked as a permanent host is exempt, because it does not travel; a laptop a person carries is a client, whatever it is capable of.
the check now: The inventory's role for every laptop says which it is, host or client, and nothing on the paging path, the resolver list, the backup schedule or the agents' runbooks names a client.

Put plainly: nothing the site depends on runs on a machine that closes and leaves the building, and no secret stays on one. Node0 was built to that rule, and the seed is designed to it from its first rung, where the laptop is the workstation and the backups already run to somewhere else.

The reason is not that laptops are unreliable. It is that a travelling machine is a different kind of thing from a host. It sleeps, it changes networks, it is on the wrong side of the firewall half the time, it can be lost or taken, and it is the machine most likely to be running something else at the moment the site needs it. Node0 learned each of those the mild way. A VPN client on a laptop captured the site’s own routes and looked like a fleet outage (4.17). The operating agent’s memory, moved off a laptop, landed on a path the new session never read (6.15). The site’s first year of scripts lived on a box whose root filesystem was memory and would not have survived a reboot (3.3). None of these cost data, and each pointed the same way.

So the services that matter live on hardware that stays. The agents got racked machines, and the agent that operates the site day to day moved into a guest inside the fabric on 20260917, on the same power and the same network as the things it watches. DNS and time run on the small always-on boxes and the hub. Backups run to a server, from every machine including the laptops, so a laptop is something the site protects, never something it depends on.

Secrets follow the same line. A travelling laptop holds no credential in a file. What it holds is a way to ask: a password manager and a credential to the site’s own vault, either of which can be cut off from the site the hour the laptop goes missing. Cutting off access stops the next fetch; it does not recall a secret already fetched, so what a laptop last fetched is rotated at its issuer as well, and the site keeps fetched secrets short-lived where the issuer allows. A secret that is only a copy on a disk offers neither handle; one that is fetched offers both.

The exemption is deliberate and it is about travel, not shape. agent1, agent2, dev1 and dev2 are laptops, and so are the two serving laptops, and all six are racked, cabled, on the site’s power and in its inventory as hosts. They do not leave, so they are hosts. A laptop a person carries is a client, whatever it is capable of, and the inventory says which is which.

Source: Christoph's ruling of 20260922; the as-built v0.1 (agents, bootstrap) and the seed design for the instances. Sanitized: checklist v0.1, 20260922. Part of oznog.com/node0.