PORTWRIGHT

Deploy and runbook control plane

Local-81

The control plane Portwright Labs runs every day. Push over SSH and rsync, no agent on the hosts, and a Merkle ledger that proves every run.

View on GitHub Captured run Ask Jimmer about it
Local-81 emblem. Plan, deploy, audit, hold the line.

How it runs

  1. 01

    Onboard the fleet

    Keys, ssh-copy-id, and a read-only sweep of uptime and tooling. You get a readiness report per host. Nothing is installed on the targets.

  2. 02

    Plan, deploy, repair

    Desired state goes out by rsync and is content-addressed by SHA-256. deploy --check finds drift. A converge repairs only what moved. Upgrade and rollback use the same plan.

  3. 03

    Prove the run

    Every run is hash-chained into a Merkle ledger. audit verify recomputes the chain. audit prove shows inclusion. audit emit can post a signed receipt.

  • The linchpin

    Portwright Labs uses it daily. Sites, software, and managed storefronts only stay true if the hosts match the plan and the next operator can show what ran.

  • Secrets never at rest

    Config holds references — env, OpenBao, SOPS, or Delinea — not literals. Sudo passwords stream on stdin and are scrubbed from every artifact.

  • Named for a real local

    Local 81 was the bakery union at the Chef Pierre plant in Traverse City. The tool keeps that standard: a plan you can read, and work you can hand to the next operator.

The rest of the bench