Customer infrastructure

MIOSA can orchestrate products across infrastructure operated by MIOSA or controlled by the customer.

The product keeps one resource model and control plane while placement determines where work executes.

Provider accounts, regions, pools, host inventory, placement policy, and verification receipts belong to the organization.

Workspace-specific environment variables, secrets, projects, and workload defaults remain workspace scoped and are applied only after organization capacity is selected.

Choose an infrastructure model

MIOSA operates compute, networking, host lifecycle, capacity, and placement.

Connect an individual workstation or owned server through an outbound agent session.

Install a governed MIOSA worker region inside a customer AWS account or Google Cloud project.

Keep governed workloads in customer infrastructure and use other capacity only where policy permits.

OpenComputers and Bring Your Own Cloud are different products.

OpenComputers connects individual machines.

Bring Your Own Cloud creates a governed cloud capacity region that remains orchestrated by the MIOSA control plane.

Control plane and customer cloud

MIOSA remains the orchestration authority.

The customer controls its cloud account, identity policies, network, provider resources, and provider bill.

MIOSA controls desired capacity, placement, immutable runtime generations, host acceptance, scheduling, drain, and reconciliation.

Provider foundations

Provider	Current package	Current boundary
AWS	Terraform and CloudFormation	Private networking, scoped identity, immutable host templates, artifact inputs, and fail-closed acceptance
Google Cloud	Terraform	Separate keyless actuator and worker identities, network, firewall, immutable host image, artifact access, and acceptance handoff

Activation sequence

Create the customer-cloud region in MIOSA.
Apply the reviewed provider package in the customer account or project.
Register the provider outputs with MIOSA.
Run identity, network, quota, image, and artifact preflight.
Boot one acceptance worker.
Verify KVM, storage, runtime generation, authenticated session, and workload execution.
Record the evidence.
Record separate Sandbox, Computer, and Deployment verification receipts for every workload type that will use the pool.
Explicitly enable placement.

Infrastructure creation does not make a region live.

Placement begins only after the full acceptance contract passes.

Shared responsibility

Responsibility	Customer	MIOSA	Cloud provider
Account or project ownership	Owns	Validates access	Hosts account services
IAM and network policy	Approves and owns	Requests scoped capabilities	Enforces
Worker runtime	Supplies capacity	Versions, verifies, and reconciles	Runs infrastructure
Workload placement	Sets policy	Schedules and records	Provides compute
Provider billing	Pays	Reports MIOSA usage separately	Bills resources
Host health	Receives incidents	Verifies runtime census and acceptance	Reports infrastructure state

Product contract

Your product should not need a different workflow for every provider.

MIOSA resolves the target, checks policy and capacity, dispatches work, and reports one status and evidence shape.

Use OpenComputers for individual owned machines.

Use customer-cloud regions for governed pools of AWS or Google Cloud capacity.

Use MIOSA-managed compute when the customer does not require a cloud-account boundary.