Live Stack
Stack Status
High-level architecture, public-safe VM telemetry, and selected project milestones. Enough context to show the work without exposing administrative detail.
Fetching VM telemetry…
Security posture: Internal hostnames, addresses, and administrative surfaces are not published here. Administration remains private, while public services enter through a controlled edge layer.
Trust Plane Model
Everything operates within one of four trust planes. Plane membership determines access rules, not role, not convenience.
Plane A
Public Internet
Untrusted. Browsers, mobile, bots, scanners. Zero trust assumed.
Plane B
Private Overlay / Remote Access
Controlled remote access supports private services. Device identity and trust policy govern access while the long-term model is evaluated.
Plane C
Virtualization Layer
Virtualization substrate. No direct public ingress; platform access remains private.
Plane D
Service / Workload Plane
Application and service workloads across virtualized and dedicated hosts. Isolation follows trust boundary and operational role.
Platform VM Telemetry
Public-safe virtualization state for applicable workloads. This feed does not represent physical hosts, logical roles, or application-level health.
Core Architecture State
Curated lifecycle state for foundational systems. These cards are intentionally independent of the VM telemetry feed.
ForgeCharon
Network control plane with managed switching and trust-zone segmentation
Active
ForgeGolem
Configuration automation using scoped service credentials and repeatable policy
Active
ForgeNexus
Durable storage and recovery-data foundation with consolidation verified
Operational
Secondary virtualization platform
Separates storage, recovery, and media responsibilities from primary compute
Operational
Controlled file access
Authorized private access to central storage with reboot persistence validated
Operational
ForgeCloud
Read-only media presentation from protected storage
Operational
ForgeThoth
Backup and recovery orchestration foundation; protected-backup and automated-recovery workflows remain in development
Building
ForgeTower
Security observability / SIEM
Planned
Service & Domain Inventory
Workloads are separated by trust boundary and operational role. Public, internal, data, and support services are split where isolation, lifecycle, or recovery requirements justify it.
Skald / Intelligence Layer
Skald is the intelligence and orchestration layer above Norn and controlled infrastructure tools. Norn owns curated operating state; Mimir is its durable knowledge authority. Its active operational pillars are Atlas, Mimir, Fountain, Vault, Ledger, and Writing, with Saga as the cross-pillar chronicle. Writing is still validating, while Capture and Calendar remain ancillary workflow layers. Syd Prime is the primary orchestration role. ForgeGolem separately holds scoped service credentials for repeatable automation, and the credential authority cannot be read directly by AI models.
Norn
Local-first operating state and shared authority; Writing remains under validation
Production
Writing
Newest Norn operational pillar; interface live while sync and imports are validated
Validating
Skald API
Private, unprivileged orchestration interface
Working prototype
Local Inference
Private model runtime with a verified functional path
Operational baseline
Syd Prime
Primary Skald orchestration role, independent of physical host identity
Operational baseline
Agent Runtime
Replaceable local agent and session layer
In development
Tool Broker
Controlled, auditable actions
Planned
Specialist Routing
Bounded delegation to purpose-built workers
Planned
ForgeCrucible
Independent specialist workbench; not an integrated production Skald service
In development
Project Milestones
Selected outcomes that materially changed TekForge, its tools, or the way the environment operates.
-
ForgeCloud media presentation validatedIndependent media presentation came online with read-only access to selected stored libraries. External HTTPS playback and stable routing were validated without making the presentation layer the storage authority.
-
Controlled file access validatedA dedicated private access layer enabled authorized browsing and file operations against the central storage authority, with reboot persistence verified.
-
ForgeNexus consolidation completedDurable data was consolidated with verification and retained sources while private storage and presentation consumers remained separated.
-
Skald reached a private runtime baselineThe unprivileged orchestration API, local inference, and Norn-aware retrieval path survived privilege and service hardening, a reboot, and functional validation.
-
Secondary virtualization and storage platform commissionedAn additional virtualization platform entered service to separate storage, recovery, and media responsibilities from the original compute platform.
-
Syd Prime entered build and stagingThe primary orchestration role entered build and staging, establishing the hardened local foundation for Skald.
-
Endpoint-management service hardening completedCredential rotation, configuration review, and service validation strengthened the endpoint-management platform.
-
Norn established shared operational authorityNorn’s established operational pillars and Saga adopted shared authority, followed by browser and second-device validation. Writing arrived later and is tracked separately while validation continues.
-
Network control foundation entered active useForgeCharon and managed switching established segmented trust zones, private name resolution, and controlled remote access as the working network foundation for later workload migration.
-
Arcenhammer reached private NornPrivate name resolution and trusted TLS were validated on the hardened mobile endpoint, allowing Norn to use its private access path without exposing the service publicly.
-
ForgeWorx released as a local-first open-source toolkitCompass, Vault, and Ember turn the action, memory, and health boundaries proven inside Norn into a portable toolkit that can be used without carrying personal data or infrastructure-specific state.
-
Sportsball released after real tournament useThe offline-first Android bracket manager supports single elimination, double elimination, pool play, and round robin. It ran a fifteen-team event from check-in through the final match before release under the MIT license.
-
Norn unified six personal-operations pillarsAtlas, Mimir, Fountain, Shop, Vault, and Ledger now operate as one suite for action, memory, health, procurement, inventory, and finance, with shared navigation across web and Android.
-
Duties deployed as a managed daily-support applicationA purpose-built Android application now supports daily tasks, planning, check-ins, and review on a managed device, reducing friction between the plan and the place where it is used.
-
UPS-backed graceful shutdown establishedThe primary virtualization host now monitors battery state and shuts workloads down in a defined order before power exhaustion, replacing a full-stack hard outage with a controlled stop.
-
Managed network segmentation introducedPublic, administrative, virtualization, server, and untrusted traffic now have explicit trust boundaries instead of sharing one flat network. Routing policy is being centralized at the firewall.
-
ForgeMind publishing surface launchedA separate public publishing environment created a home for Open Wavelength while keeping its identity and content distinct from TekForge and other operated domains.
-
React2Shell exposure reviewed and ruled outProbe activity against a critical React vulnerability triggered a full review of public services. The traffic was blocked at the edge, and the affected technology was not present in the exposed stack.
-
ForgeHound MDM enrolled its first managed endpointSelf-hosted Android management now provides device-owner enrollment, policy enforcement, application delivery, and a custom launcher for a real family support use case.
-
TekForge Commons launchedA private, invite-only community space now runs on TekForge infrastructure, giving collaboration and discussion a home without depending on a public social platform.
-
Ansible baseline extended across the VM fleetPackages, time synchronization, SSH hardening, connectivity checks, and firewall expectations now share one repeatable baseline across in-scope systems.
-
Backup recovery verified through restorationRecovery moved beyond having backup files: a restore test proved that protected systems could be brought back and their primary services validated.