SCFDocs
SCF / Documentation / Adaptation

SCF product profiles

Version: 0.1

1. Purpose

A profile narrows SCF for a class of system. It adds requirements; it never removes them. One product MAY carry several profiles.

branded kiosk appliance
= kiosk and single-purpose terminal
+ appliance and embedded device
+ immutable and atomically updated system
+ white-label derivative

Each profile states mandatory properties, permitted variation, invariants that survive all variation, the HIF profiles that apply to its human-facing surfaces, and the additional evidence its release gate requires.

Where two profiles conflict, the stricter requirement applies. A product MUST declare its profiles in the product profile record before implementation.

2. General purpose desktop

Applies to interactive multi-user workstations and personal systems.

Mandatory

  • disk encryption offered as a first-class installer choice, with a documented recovery path;
  • no listening network service enabled by default;
  • automatic security updates enabled, with a described control to postpone;
  • telemetry off until an explicit choice is made;
  • graphical, keyboard and screen-reader accessible paths to every security decision, including before authentication;
  • a working recovery mode reachable without a network;
  • hardware matrix published, including graphics, wireless and suspend behaviour on reference devices;
  • a documented answer to what happens when an optional network service is unavailable at boot.

Permitted variation desktop environment, session manager, package selection, theme, density, default applications.

Invariants the identity of user data, the semantics of authentication and privilege escalation, and the update contract do not change with the desktop environment.

HIF OS Shell Profile, Desktop Application Profile, Installer and Recovery Profile, Documentation Profile.

Additional evidence suspend and resume, external display, unlock from a locked screen, and full-disk-encryption unlock verified on reference hardware.

3. General purpose server

Applies to headless systems administered remotely.

Mandatory

  • remote administration hardened by default: no password authentication for administrative access, no direct root login, key or hardware-token based;
  • the set of listening services is enumerated and minimal;
  • unattended installation contract documented and reproducible;
  • time synchronisation configured, and authenticated where the shipped client supports it;
  • logs retained with bounded size, and security-relevant events recorded;
  • a documented path to apply security updates without a functional upgrade;
  • the console remains usable when the network is unavailable.

Permitted variation init configuration, filesystem layout, container runtime, orchestration agent.

Invariants an administrator can always determine version, channel, update state and security policy from the running system.

HIF Documentation Profile, Terminal and Command Profile, Builder and Administrative Profile.

Additional evidence unattended installation executed end to end from the published answer file; recovery from a failed update demonstrated.

4. Appliance and embedded device

Applies to single-function devices where the operator is not the end user and physical access may be uncontrolled.

Mandatory

  • no shared credentials across units; per-device secrets generated at first boot or provisioned individually;
  • update mechanism functional without human presence, and safe when interrupted;
  • rollback to the previous known-good state, tested per release;
  • storage encryption where the device holds personal or operational data;
  • physical-interface exposure declared: serial consoles, debug headers, recovery buttons, and what each permits;
  • an offline update path with the same verification guarantees as the online one;
  • decommissioning procedure that erases secrets and data.

Permitted variation filesystem layout, A/B or commit-based update, read-only or writable root.

Invariants a device that fails an update remains bootable and recoverable; a diagnostic mode never bypasses verification.

HIF Kiosk and Distance Profile for any local surface, Builder and Administrative Profile for management surfaces, Documentation Profile for the operator manual.

Additional evidence power-loss during update, on reference hardware, repeated; rollback after a deliberately broken update.

5. Kiosk and single-purpose terminal

Applies to systems operated by the public or by staff in a fixed role.

Mandatory

  • the session cannot be escaped into a general-purpose environment through file dialogs, help systems, external links, keyboard shortcuts or crash recovery;
  • session data is destroyed between users, verifiably;
  • an unattended failure returns to the working state without a person;
  • the maintenance path is authenticated and distinct from the public session;
  • no personal data persists on local storage unless the profile requires it and it is encrypted;
  • attract or idle behaviour never conceals the fact that a session is active.

Permitted variation input modality, hardware form factor, presentation.

Invariants the public session never gains administrative privilege; the maintenance path never runs in the public session's context.

HIF Kiosk and Distance Profile in full, including accessibility of the public surface.

Additional evidence an escape-attempt corpus executed against the built image, including every dialog that can reach a filesystem or a browser.

6. Security and forensics workstation

Applies to systems whose purpose is testing, analysis or incident response.

Mandatory

  • the tool inventory is declared, with the licence of every non-free component verified for the intended redistribution;
  • the distribution and export constraints of the tool set are enforced at delivery, not only stated;
  • the boot-integrity posture is stated plainly, including the common case where the upstream base does not support firmware verification;
  • evidence-handling properties are documented: what the system writes to attached media, what it caches, what survives a reboot;
  • a live mode that leaves no trace is either provided or explicitly absent.

Permitted variation desktop, tool selection, persistence model.

Invariants the system never misrepresents its own integrity posture; capabilities that can damage third parties are never enabled by default.

HIF OS Shell Profile, Documentation Profile.

Additional evidence a written statement of which upstream trademarks were removed and how the removal is enforced mechanically.

7. Immutable and atomically updated system

Applies to systems whose root is not modified in place.

Mandatory

  • the system volume is integrity-verified at run time, anchored in the boot chain;
  • updates are atomic with an explicit activation step and a bounded number of boot attempts before automatic rollback;
  • the supported mechanisms for local extension are documented, and unsupported modification fails loudly rather than silently;
  • state, configuration and system content are separated, and the boundary is documented;
  • anti-rollback protection is defined;
  • the recovery path works when the current and previous deployments both fail.

Permitted variation commit-based, image-based or A/B partition deployment.

Invariants an update that fails to boot never becomes the default; the system can always state which deployment it is running.

HIF OS Shell Profile, Installer and Recovery Profile.

Additional evidence forced-failure rollback and anti-rollback both demonstrated on reference hardware.

8. Regulated and air-gapped deployment

Applies to systems deployed under an external compliance regime or without network connectivity.

Mandatory

  • the applicable baseline is named with its exact revision, and conformance is measured mechanically against it;
  • deviations from the baseline are registered as exceptions with a justification and an owner;
  • an offline update and verification path exists, with the trust anchors distributable out of band;
  • the bill of materials, the provenance attestation and the exploitability statements are delivered with the release, not on request;
  • records required by the regime are retained for the required period;
  • the jurisdiction profile is declared, including data residency.

Permitted variation the specific baseline and its level.

Invariants a compliance claim is bounded to the measured scope and the revision of the baseline used.

HIF Documentation Profile, and Builder and Administrative Profile for audit and reporting surfaces.

Additional evidence a machine-readable conformance report against the named baseline, produced from the built image.

9. Installation, live and recovery media

Applies to artefacts whose purpose is to install, run temporarily or repair.

Mandatory

  • destructive operations state exactly which devices they will affect before they act;
  • the media verifies its own integrity before installation begins;
  • the installer records the effective configuration it applied;
  • accessibility is available before authentication and before installation;
  • a live session states clearly whether changes persist;
  • recovery media works without a network and is documented as part of the release, not as an afterthought.

Permitted variation installer implementation, text or graphical mode, attended or unattended.

Invariants the installer never silently reformats a device the user did not select; a live session never presents itself as installed.

HIF Installer and Recovery Profile, Kiosk and Distance Profile, Documentation Profile.

Additional evidence installation onto a machine with existing data, demonstrating that unselected devices are untouched.

10. Virtual, cloud and container base image

Applies to artefacts consumed by another system rather than installed by a person.

Mandatory

  • no image-baked host identity, host keys or machine identity;
  • first-boot behaviour documented, including what is generated and what is fetched;
  • the metadata service the image trusts is declared, and nothing else is trusted by default;
  • the image is content-addressed and its digest is published;
  • the bill of materials covers the image as delivered, not the recipe;
  • size, package count and installed surface are reported per release.

Permitted variation provisioning agent, filesystem, boot mode.

Invariants two instances launched from the same image never share a secret they did not obtain individually.

HIF Documentation Profile.

Additional evidence two instances launched and compared for shared secrets and identifiers.

11. White-label derivative

Applies to systems delivered under a customer's brand.

Mandatory

  • brand assets are a versioned input to the build, not a manual step;
  • upstream marks that the upstream terms require to be removed are removed mechanically, and the removal is verified by an automated check;
  • the derivation is disclosed truthfully in the system's own metadata and documentation;
  • the customer's obligations are documented: support period, update channel, vulnerability reporting, source availability;
  • ownership of signing keys is agreed in writing before the first release;
  • the platform's own updates reach the derivative without requiring a fork.

Permitted variation name, marks, palette, typography, wallpapers, documentation voice, default applications.

Invariants branding never changes security defaults, the update contract or the meaning of a command; the party accountable for the release is always identifiable.

HIF White-label Profile and the Brand Expression document, plus every profile that applies to the base product.

Additional evidence an automated check proving that no upstream mark subject to removal remains in the built image.

12. Construction service

Applies to the platform that builds systems for others — the builder, its portal, its registry and its workers.

Mandatory

  • every build runs in a boundary that survives arbitrary code execution;
  • specifications, locks, artefacts and evidence are separable per tenant, and a tenant cannot enumerate another tenant's existence;
  • signing keys are unreachable from any build environment;
  • dangerous capabilities — arbitrary hooks, unvetted external repositories, unrestricted network — are disabled by default and, where enabled, shorten the retention of the resulting artefacts;
  • inputs are validated against a schema; no free text reaches a shell;
  • quotas, timeouts and queue depth are enforced and observable;
  • a published policy states what the service will not build;
  • the service can state, for any artefact it has ever released, its lock, its inputs and its evidence.

Permitted variation engine selection, worker technology, storage backend, pricing model.

Invariants the service never signs an artefact it cannot fully account for; a tenant's code never influences another tenant's result.

HIF Builder and Administrative Profile, Web Product Profile, Documentation Profile.

Additional evidence an isolation test that attempts to escape the build boundary and to reach the control plane, executed against the production configuration and repeated per release of the build plane.