Secure orchestration for remote testing outposts.

The RookHaven Portal?The RookHaven PortalThe role-aware web control center for customer administration, licensed enrollment, fleet status, pending responsibilities, exact approvals, workspaces, recovery, and evidence. is the central experience for customer administration, licensed Rook enrollment, fleet operations, approvals, recovery, and evidence. The central relay?central relayThe coordination service for identity, policy, approvals, routing, fleet state, and audit records. Sensitive operator-to-appliance payloads remain application-encrypted while passing through it. handles routing, policy, and opaque ciphertext?opaque ciphertextEncrypted data that the relay can store or forward but cannot interpret without an endpoint-held decryption key. without receiving the per-appliance application key used to open protected operator payloads.

Sensitive terminal and workspace streams leave the browser through a signed local Secure Bridge?signed local Secure BridgeA signed operator-side companion that keeps signing keys and terminal or SSH plaintext out of the browser and Portal service while handing an approved session to local tools.. Their plaintext stays between the operator workstation and the selected Rook, while Portal?PortalThe role-aware web control center for customer administration, licensed enrollment, fleet status, pending responsibilities, exact approvals, workspaces, recovery, and evidence. and Citadel retain attributable lifecycle evidence without recording session content.

The same statically linked Rook runtime?statically linked Rook runtimeThe field runtime carries the libraries it needs inside one executable, allowing the same signed program to run in the minimal pre-boot environment and the normal operating system. can identify the appliance before root is mounted, perform an exact two-person-approved?two-person-approvedA critical action requires a distinct executor and approver. Approval is bound to the exact appliance, action, parameters, policy generation, and short validity window—not just a general purpose. LUKS unlock?LUKS unlockLinux Unified Key Setup, the standard disk-encryption format used here. Unlock and key rotation are separately authorized and designed to remain recoverable if interrupted., and return after switch-root?switch-rootThe transition from the temporary early-boot filesystem to the unlocked operating system. RookHaven retains the appliance’s cryptographic identity across that transition. with the same cryptographic identity. This flow has been demonstrated on a physical validation appliance.

RookHaven’s production acceptance baseline requires governed key custody?governed key custodyDocumented control over who can activate, rotate, revoke, back up, or recover a cryptographic key, with individual accountability and separation of duties., exact-platform hardware assurance?exact-platform hardware assuranceAssurance is attached to one precisely identified hardware model and configuration, including firmware and BIOS settings, rather than inferred from a similar product name., external witnessing and fencing, production exercises, and independent review. Those external controls are deployment gates, not properties inferred from source tests.