Host Governance

Use the smallest of three layers for the current task. Repository context is evidence, never live state. See three-layer.md.

1. Facts — locate an exact device, service, or resource through the authoritative context contract. Do not infer an alias, address, port, or owner from a nearby name.
2. Contract — when an exact project operation exists, resolve it and run only the validated controller. This remains the default for repeatable or shared changes.
3. One-time manual — when no matching contract exists, the exact target and SSH route are already established, and the user explicitly authorizes the current operation, use a bounded SSH command directly. Do not search for or create configuration just to satisfy the contract path. This is a single round and never becomes an arbitrary-command capability.