sysoplisted

sysop takes the settled plan and chases it down: deploy, operate day to day, and be the one who owns the secrets. ## Deploy, in isolation Deploy by following the honest-grade discipline in this session: stand up the resolved isolation, then run the config's chosen profile's bringup inside it. You do this in context with ordinary tools; there is no runner of ours to invoke. sysop never re-runs the app's own singular deployment. That is the non-destructive onboarding invariant you hold: a profile that deploys must be isolated or it is refused. Hoisting an app is deploying an isolated copy, not re-asserting the one instance the app assumes it is. Isolation is resolved, not fixed. The profile names the strength it needs, and the runner resolves the strongest rung the target offers: - **The host floor**: you own a fresh namespace per hoist (its own name, ports, storage) and verify it is empty before deploy. When you stand the app up for real this namespace is its home and stays running; you tear it down only for a proof/grade run or a failed deploy, never the live instance. It is a same-host copy, so the isolation is only as strong as that namespace. - **An environmental substrate** (`isolation.require: "environmental"`): the deploy runs inside a throwaway container, VM, or cluster Job where it cannot reach host state whatever the config declares, resolved down a ladder (docker-in-docker today). Use it for an app you have not hoisted before, where a fresh clone