Control Plane
Owns runtime configuration, process lifecycle, supervision, and system state without becoming part of the personal Substrate.
The Control Plane answers what is installed, configured, running, paused, trusted, or failed right now. These facts operate the system; they are not the user's Timeline.
Core lifecycle, system.db, workspace selection, App and Connector registries, run state, schedules, and supervision.
Host-only lifecycle and management APIs consumed by the trusted Shell and operator tooling.
Connector integrations and runs, approvals, credential metadata, settings, checkpoints, warnings, and mutable policies.
Personal Events/Documents/Tables, provider secret values, Guard's data.db connection, or App business logic.
Process topology
Electron Host / standalone operator
│
├── Core ─────────────→ system.db
│ ├── App registry + channels
│ ├── Connector supervisor
│ └── Shell / operator APIs
│
└── Guard service ────→ data.db
└── isolated SQL executorCore and Guard are separately supervised processes. Core does not open data.db; Guard has no system.db handle. The Host owns their private authentication material and startup order.
Control state
| State | Why it belongs here |
|---|---|
| Source pause/readiness/run status | Changes execution policy without rewriting existing Events. |
| Schedules, retries, timeout, concurrency | Mutable operational policy, not static package truth. |
| Package trust approvals | Authorizes the current Connector hash, not captured personal data. |
| Credential references | Bind integrations to secret custody without exposing secret values. |
| Warnings and health | Describe current operation and recovery, not meaningful Timeline activity. |
Lifecycle contract
- The Host selects or opens a Workspace and creates canonical
.lamarck/state. - Guard starts and becomes the sole managed
data.dbowner. - Core opens
system.db, loads package registries, and starts supervisors. - Interfaces become available only after required private channels are established.
- Workspace switch or shutdown revokes App channels, stops children, drains admitted work, and closes database owners in order.
An unexpected Guard or Capsule failure closes the affected capability path. Lamarck does not fall back to executing App commands directly on the Host.