orchestration mode
let a trusted machine create, scale, and retire other machines through the built-in ironwire CLI. build an autoscaler, a deploy bot, a nightly janitor.
the concept
every machine carries its own identity (a per-boot SSH key) and talks to the platform through the preinstalled CLI. by default it can look, not touch. orchestration is a per-machine switch that upgrades one specific machine to act on your behalf across the fleet.
enabling it
<SCREENSHOT: actions popup with the orchestrate checkbox visible on a machine row>
only you (the human owner) can flip the switch; a machine can never grant itself orchestration.
dashboard
cursor to the machine, press c. or open the actions popup with Space and use the c checkbox, labelled orchestration (drive the fleet via the CLI).
in list output, orchestrating machines show the O flag; info <name> shows orchestrate: on.
what a machine can do
| Normal machine | Orchestrating machine | |
|---|---|---|
read & introspect: list, info, stats, usage, whoami, images | yes | yes |
| manage env vars and ports | yes | yes |
lifecycle: create, copy, resize, stop, start, restart, pause, resume, rm | no | yes |
| set or clear a custom domain | no | yes |
| shell into your other machines | no | yes |
| toggle orchestration or delete protection | no | no (owner only, in the dashboard) |
a machine without the switch that tries a gated verb gets this machine is not allowed to control the fleet (ask the owner to enable orchestration); reaching a sibling's shell fails with this machine is not allowed to reach other machines (orchestration is off). machine sessions are always scoped to your account and are never admin.
protect your controller
delete protection is the other dashboard toggle (key g). it blocks rm for everyone, including orchestrating machines: machine "<name>" is delete-protected; turn protection off first. turn it on for your controller; a bug in your own automation can never delete the machine running it. protected machines show the P flag in list.
lineage
machines created by another machine record who made them. trace what your automation built.
ssh
$ ssh dashboard@ironwire.sh info worker-2 … created-by: machine <id>
cli
$ ironwire info worker-2 … created-by: machine <id>
dashboard
use info over ssh or the cli; the machine list does not show lineage.
the created-by line appears only on machine-created machines (created_by in JSON output).