The landscape, honestly.

Those products excel at confidential-compute enclaves for sensitive workloads. DE:SH is the simpler general-purpose host underneath — a hypervisor you can audit from the outside, designed to host the rest of the Decent Edge family without needing an enclave deployment first.

Those tools describe what should happen. DE:PLOY makes it happen — and corrects itself when it doesn't. Templates and agents handle the routine; humans review the exceptions.

Those products specialise in detection and reporting. DE:FENDER specialises in coordinated response — it talks to DE:PLOY so a confirmed incident becomes an isolated workload before a human picks up. It complements detection-first stacks rather than replacing them.

Those tools focus on the network path and identity layer. DE:RAC adds an operator-console UX with ephemeral credentials per session and keystroke-level audit baked in — designed for managing infrastructure, not just opening connections.

Those products give you encrypted backups. DE:SAFE goes one step further: keys never reach our infrastructure, so a compelled-disclosure request to us produces nothing decryptable. The same primitive works for VM snapshots, container volumes, and persistent state.

DE:STORE is sized for the Decent Edge family, not aiming for hyperscaler breadth. Curation, verified publishers, and clean API-driven installation are the primary goals — not catalogue volume.

Those products are dashboards that collect evidence after the fact. DE:EPER is a rig that produces evidence as part of the build pipeline — the same way unit tests produce test results. The auditor verifies what the rig wrote, byte-for-byte, against the recipe.

Those platforms target arbitrary container or sandbox workloads. DE:LIGHT is a focused lightweight server — two well-defined execution modes, a signed receipt per call, and hardware attestation inherited from DE:SH. Run it on your own hardware or use the managed services.

Those platforms are identity providers. DE:SIGN is a signing service — the WebAuthn credential is also used to approve infrastructure operations, not just authenticate the session. It integrates directly with DE:SH's dashboard and DE:PLOY's task queue so an operator approval is cryptographically bound to the action it authorises.

Those platforms automate with scripts or general-purpose AI. DE:LTA is a goal-directed agent that is part of the Decent Edge trust chain — every autonomous decision it makes is HATP-attested, so the output is cryptographically auditable. Fleet management, infrastructure remediation, and cross-actor orchestration all run through the same attested agent loop.

DENSE narrows the scope: actor-shaped programs only, no Linux guest, no general-purpose POSIX. The narrow scope is what makes the warm dispatch fast and the receipt simple.

DEMIX is the medium-isolation tier in DE:LIGHT's spectrum, not a general-purpose sandbox platform. Borz actors get supervised lifecycle, gRPC fabric, and a signed receipt per spawn — useful when you want isolation, but the workload is small enough that a full Linux VM is overkill.