How a first host works
We install. We walk out.
SST never hands a customer a zip, a git clone, or a build context. You get a running system on a box you hold, a Charter grant bound to that instance, and support.
One product. Usually Citadel. We name the box, the roles, and the limits — including the shared-database SPOF if HA is in scope.
Hermes rehearsal on a laptop or lab VM. Failure injection. You keep the sealed report. Secrets never enter it.
White-glove on your host or a host we specified. Signed, digest-pinned images. No source tree left behind.
Charter issues the code. Term starts at generation. On-prem must reach the license office to apply or renew. Then we leave.
What stays with SST
Charter, the Aegis control plane, Halo signaling, and Hermes live cloud apply. Those planes are how we issue grants and refuse to become a public file drop.
Residual risk we will say out loud. After walk-out the bits still sit on disk. A cloned VM is a cloned instance. Control is the bound grant, the heartbeat, and the planes we hold — not a promise that a disk cannot be copied.