Skip to main content
mothership is a deployment-internal executable. It migrates, serves, diagnoses, and recovers the platform while loading the configured Code.Storage product. It is the privileged runtime boundary, never authors or publishes a product, and has no public SDK or customer CLI contract.

​
Serve and migrate

Both fetch the exact signed Code.Storage release with read-only Git authority. Explicit --model-dir support is retained only for isolated tests and fixtures, never the ordinary product path.

​
Capture

The deployment-owned source-sync job captures declared source datasets on its fixed cadence. Serving HTTP replicas never contact customer systems as a startup or timer side effect. An administrator invoking this command crosses the same complete-capture boundary — it is not a second rail.

​
Verify

audit-verify reads back the audit archive independently. grants-check confirms the provider’s role configuration matches the committed bindings — including that no bijection.* permission has appeared in the provider catalog.

​
Production assurance

Assurance requires one closed content-addressed manifest referencing independently retained provider evidence: authentication, membership, MFA, and session records; administrative, deployment, and request records; and an approved access recertification. Bijection verifies coverage, age, workspace identity, hashes, and retention references — and retains no raw provider log.