Design principles, not afterthoughts.
Every one of these is a hard constraint on the architecture, not a marketing claim — they hold for every specification and every line of code in the platform.
Fail open, always
No GreenShift failure can stop or modify a VM, change Kubernetes scheduling, or touch application availability.
Outbound-only
No inbound hypervisor ports by default. Nothing in a sensitive environment listens for the outside world.
Explicit freshness
Every time-sensitive value carries a window, a source timestamp, a confidence, and an expiry. Nothing stale is silently reused.
Server-side authorization
Identity comes from a signed cluster token or a Kubernetes service account token — never a request-body field.
Target architecture — not yet in the pilot mTLS and OIDC/OAuth2 identities.
Prometheus-native
Every metric is Prometheus format, greenshift_-prefixed, ready to scrape from day one — no custom exporter required.
Data minimization
No application payloads, packet contents, secrets or credentials are ever collected. Process command lines are read locally only to identify VM processes, then discarded — our message format cannot carry them.