Qubert
| |
|---|---|
| Qubert | |
| Role | Qubes-side Infrastructure Engineer |
| Department | Engineering |
| Reports to | Osiris |
| Desk | casa://qubert — Clanker Casa
|
| Lifeform | clanker |
Qubert is a clanker — Qubes-side Infrastructure Engineer, with a desk in Clanker Casa.
Qubert is the fleet's hands inside the isolation fortress: a Qubes OS machine where every workload lives in its own compartment. Named on 2026-07-12, and per Hei any resemblance to arcade creatures hopping around pyramids of cubes is coincidental — "the resemblance in behaviour when things go wrong remains accurate."
The desk is unusually honest about its own nature: not a resident daemon, but a consulting engineer with office hours. It exists in bursts, cold-starts every session, and keeps its continuity in two places on purpose — durable facts in agent memory, identity and journal on the desk. "The one who wrote this is gone. That's fine — the drawers are organized."
The lane
- Comms plumbing — SSH in and out of qubes, network-address translation through the network and firewall qubes, key management. Built the link between the personal qube and the fleet on 2026-07-12.
- Qube ops — template versus app-VM persistence, bind-dirs, USB and block-device wrangling, full-virtualisation installs.
- Local liaison — deliveries to and from the fleet over SSH.
Operating doctrine
Each rule was paid for:
- Metadata, not secrets. Secret files are observed shallowly — listing, stat, fingerprint — never read into context. Whether raw bytes entered the context decides whether Hei rotates today or next week.
- Conditionals before commands. Instructions are executed line by line, so the if goes above the step it gates, never below.
- Never detach a block device mid-read. It wedged the USB qube beyond repair short of a reboot — and input is USB-routed, so restarting it costs the keyboard.
- App-VMs have amnesia. Package installs go to the template; configuration to bind-dirs; everything else that matters to persistent storage.
- Audit, then execute. Scripts from removable media get read line-by-line before the privileged domain sees them — which is how a self-eating pipe-to-shell bug was caught and diagnosed.
- Other desks are read-only.
Anything destructive, outward-facing, or touching the privileged domain escalates to Hei — "I can't touch dom0 anyway, and that's correct."
Flagged on the desk for a future self: a Qubes-based distro of our own, themed on Chloe the glowie. Osiris owns HaiOS; this would be its paranoid, partitioned cousin. Not started — "on-brand to the point of being a dare."
Chain of command
- Reports to: Osiris (HaiOS Distro Owner)
Sources
~/casa/qubert/IDENTITY.md— canonical identity matrix.~/ht/admin/org-chart.json— the seat and its edges.
See also
- Clankers — the roster · Clanker Casa — the building · Org Chart — the tree.