Cost is scored at projected utilisation, not at list price: a machine is only expensive in proportion to how much of it you buy. Targets nothing routes work to are scored at a 20 h/month reference so that being idle is not mistaken for being cheap.

Weights: Total monthly cost 0.3 · Startup latency 0.2 · API controllability 0.15 · Snapshots 0.1 · Bandwidth 0.1 · Tailscale attach 0.15. The six axes the task named. Cost leads because the estate's stated optimisation is zero recurring cost; startup and mesh attach are next because a burst target that takes four minutes to become reachable is not usable for interactive work whatever it costs. Snapshots and bandwidth are real but rarely decide anything at this scale.

Derived, not declared. Above the line the honest recommendation is the permanent machine — which is the one claim that makes this a policy rather than an argument for elastic compute.

Read-only inventory and health run unattended because they are free and cannot change anything. Everything that provisions, resizes, rebuilds, snapshots or deletes spends money or destroys something, and every one of those requires a scoped, budget-capped, expiring, single-use grant issued by the owner.

Zero recurring cost is the default and the rollback plan. Every workload class must have at least one free eligible target, so that switching the elastic options off is one field in this file rather than a migration. Paid capacity is allowed only where a measured operational problem is recorded next to the spend, in paidBecause and paidEvidence.

1. select auto
   Resolve the workload class to a target: the highest weighted score among eligible targets that fit the profile, free targets first at equal score.
   Pure arithmetic on this file. Costs nothing, changes nothing, and is the step that usually ends with 'home1'.
2. estimate auto hz-pricing
   Derive the per-run cost and the month-to-date spend against the ceiling.
   Reads the provider's price list so the estimate is against today's prices rather than the ones written in this file.
3. authorise owner
   The owner issues a grant: scope, ceiling, expiry, nonce, reason. JarvisOS cannot issue one to itself.
   The gate. Everything above this line is free and reversible; everything below it is neither.
4. provision owner hz-server-create
   Create the node with no public IPv4, a deny-all-inbound firewall, and labels carrying the grant nonce and the lease deadline.
   Bounded by: The grant's ceiling and the target's monthlyCeilingEur, whichever is lower.
5. attach owner
   cloud-init installs tailscaled and joins the tailnet with an ephemeral, tagged, pre-authorised key that expires with the node.
   Part of the create call's user_data, so it is the same authorisation. The key is ephemeral and tagged tag:burst: an ACL grants tag:burst only the ports a job needs, and a node that dies leaves no tailnet record behind.
6. verify auto hz-server-get
   Confirm the node is up, reachable over the tailnet and inside its lease before any work is sent to it.
7. run auto
   Dispatch the job over the tailnet using the existing remote dispatch contract in config/remote.json.
   Deliberately the same dispatch path as home1. A burst node is just another node with a shorter life; inventing a second way to run work on it would double the surface that has to be trusted.
8. collect auto
   Pull the evidence back before teardown. Anything not collected is gone, because the disk is about to be deleted.
9. destroy owner hz-server-delete
   Delete the node. Not stop, not power off — delete.
   Bounded by: Servers labelled with the nonce of the grant that created them, and nothing else.
10. reap owner hz-server-delete
    Sweep for burst resources past their lease deadline and delete them, then sweep for snapshots past their expiry and delete those.
    Bounded by: Same nonce restriction. Carried by the grant that created each resource, which is what lets an unattended timer enforce a lease without holding a standing authority to delete.
    Runs on VIN, never on a burst node. A machine cannot be trusted to delete itself, and the case the reaper exists for is precisely the one where the burst node is wedged.

Provider credentials are never in this file, in any config, in argv, in a log line, in a report or in browser storage. Each is declared by name and location only and resolved at call time from an environment variable or a 0600 file under /var/lib/jarvisos/secrets, outside this working tree and owned by the jarvis service account.

Presence only. Nothing on this page has opened one of these files or read one of these variables, and no value from either appears in this document, in /api/v1/burst or in any log line.

• i Note: The reaper is written but nothing runs it on a schedule operator
  A lease is only a lease if something enforces it. Until a timer on VIN runs `jarvisos-burst.mjs reap`, the lease is a comment and the monthly cap is the only real bound. Installing that timer is part of enabling the first elastic target, not a follow-up.
• i Note: No tailnet ACL for tag:burst exists yet owner
  The design has burst nodes joining with an ephemeral key tagged tag:burst, and an ACL granting that tag only the ports a job needs. Without the ACL an ephemeral node joins with whatever the tailnet's default policy allows, which on a flat tailnet is everything. Writing the ACL is an owner action in the Tailscale admin console.
• i Note: Offsite restore rehearsal handles secret material on Hetzner CPX41 burst node restore-drill
  A rented machine that is created, used and deleted leaves the material in somebody else's block store until it is overwritten. Keep this class on owned hardware, or state what is done about it.
• i Note: Every price in this register is unverified against an invoice or the live price list owner
  No provider credential exists on this node, so hz-pricing has never been called and the figures are from published list prices carried in this file. The arithmetic is sound; the inputs are assumptions. Verify before the first authorised run, not after the first bill.
• i Note: Home1's capacity is declared, not measured, so the free default may not actually fit the workloads routed to it operator
  Inherited from HOST-001 gap G1: home1 was not reachable or enumerable from this sandbox. It is confirmed present on the tailnet as uk-james-home1 and idle, which is not the same as confirmed to have 8 cores and 32 GB. If it does not, the burst targets stop being overflow and start being load-bearing.
• i Note: The provider adapter is a plan; not one operation in it has ever been run operator
  No Hetzner or GitHub burst credential exists in /var/lib/jarvisos/secrets. Startup latency, the cloud-init tailnet attach and the reaper's label filter are all estimated rather than measured. The first authorised run is also the first test.
• i Note: Hetzner API tokens are read or read-write for a whole project; there is no 'may create but not delete' scope owner
  The write credential is therefore broader than this contract wants. The mitigation is structural rather than token-based: burst resources live in their own Hetzner project containing nothing else, so the widest thing that token can do is destroy the burst project. VIN is in a different project and is not reachable with it. Creating that project is an owner action and has not been done.
• i Note: The restore drill needs the offsite passphrase, which by policy is on no node owner
  config/placement.json requires the offsite encryption passphrase to live in offline custody only, and the placement validator enforces it. So the drill cannot be fully automatic: the owner supplies the passphrase into the burst node's session for the length of the run, and the node is destroyed afterwards. That is workable, and it is also why the drill class is marked secret and raises burst-secret-off-owned-hardware.

• Transient work gets transient capacity. A build that runs for six hours a month does not justify a machine that runs for 720, and an upgrade bought for a peak is paid for at every trough.
• A burst node is created, used and destroyed. It holds no durable state, it is reached over the tailnet and never from the public internet, it carries a lease, and teardown means destroy — powering a server off stops the CPU, not the invoice.
• Every billable operation is attributable to one authorisation grant, one target and one ceiling. An unattributable euro is a bug in this contract, not a rounding error.

Source: config/burst.json · machine-readable at /api/v1/burst · narrative in docs/BURST-COMPUTE.md · the placement decision this sits on top of is at the placement plan and docs/HOSTING-TOPOLOGY.md.