Safety model

Hostwright keeps runtime changes behind a reviewed plan, explicit confirmation, and local daemon authority. The v0.0.2 development build is not GA-qualified.

Before a lifecycle change

Run the corresponding command with --dry-run, inspect every proposed resource change and policy explanation, then confirm only that current plan with its hash. The daemon revalidates the manifest, plan, provider capability, reservation, and request authority before effects. If any value has changed, the plan must be reviewed again.

apply remains a compatibility route to confirmed up. The ordinary up, down, restart, and related commands expose the lifecycle directly. Use the CLI reference for exact flags.

Cleanup and ownership

Cleanup has a separate dry-run and confirmation token. It acts only on exact Hostwright-owned resources whose current identity, lifecycle state, and ownership evidence satisfy the plan. Names or labels alone do not prove ownership. Unmanaged or ambiguous resources fail closed.

Intent and recovery

Hostwright records operation intent and checkpoints in local state before runtime effects. It verifies results after each effect and keeps ambiguous operations fenced until recovery can prove a safe continuation or cleanup. See Operations and recovery.

Secrets and diagnostics

Plaintext secrets do not belong in manifests or logs. Use typed local secret references and review their scope. Support bundles show a preview and require confirmation; Hostwright does not upload them automatically. Review a bundle before sharing it.

Read Security and safety, Limitations, and the core security reference before confirming untrusted input.