Dream Consistency Platform Tool
Security-sensitive one-time console utility for verifying Realm.Foundation,
creating the authoritative self Realm, and creating the first Core operator account.
DreamConsistency.RealmBootstrap.Cnsl initializes the minimum runtime identity
required for a new Dream Consistency Realm environment.
It is executed after the Realm schema has been deployed and after
DreamConsistency.Realm.Foundation has been installed by the System Catalog Installer.
Security boundary:
Bootstrap creates the first privileged Core operator.
It must be executed deliberately, reviewed before confirmation, and never run as normal API startup logic.
Run Realm Bootstrap exactly once for a newly prepared Realm environment when:
- The Realm physical schema has been deployed successfully.
- The latest active Realm schema record contains the expected contract version.
DreamConsistency.Realm.Foundation is installed and verified.- No authoritative self Realm has been created for the environment.
- No first Core operator has been created.
Do not use the tool as a general account-management, Realm-registration, or catalog-installation utility.
- Verify that the connection targets the explicitly expected Realm database.
- Read the latest active Realm
ContractVersion.
- Verify compatibility with the referenced
DreamConsistency.RealmTables contract.
- Load the canonical Foundation identities from
DreamConsistency.RealmCatalogs.
- Verify that every required Foundation row already exists in the database.
- Resolve the selected environment to its local database RefID.
- Resolve the
REGISTERED Realm operational status to its local database RefID.
- Create the authoritative self Realm.
- Create the first Core operator using the configured secure password hashing mechanism.
- Commit the bootstrap operation in the Realm transaction.
- Install Realm.Foundation or any other catalog package.
- Create or update the Realm database schema.
- Record schema deployment history.
- Install Management or Billing catalogs.
- Create application sessions, access tokens, or authentication cookies.
- Register all product applications, services, instances, plans, or subscriptions.
- Create additional operators after the initial bootstrap.
- Repair an already initialized Realm automatically.
- The Realm database exists and is reachable.
INF_RealmSchemaVersions contains the latest active schema and contract record.- The recorded
ContractVersion matches the supported RealmTables contract.
DreamConsistency.Realm.Foundation has already been installed.- The selected environment exists in
INF_Environments.
- The
REGISTERED status exists in INF_RealmOperationalStatuses.
- The local configuration contains a stable service UUID and an instance UUID.
- The operator password satisfies the configured minimum and maximum length.
Bootstrap loads the canonical package and item identities from:
DreamConsistency.RealmCatalogs
└── DreamConsistency.Realm.Foundation
├── INF_Environments
└── INF_RealmOperationalStatuses
It verifies that the database rows:
- Exist under the expected UUID.
- Have the expected name.
- Are not duplicated.
- Are not soft-deleted.
- Do not have the expected name assigned to another UUID.
No duplicate source of truth:
Bootstrap does not maintain its own hard-coded Foundation catalog definitions.
Canonical UUID identities come from DreamConsistency.RealmCatalogs.
Product-neutral and non-secret defaults belong in appsettings.json.
Local instance values and database credentials belong in appsettings.Local.json.
{
"ServiceInfo": {
"Name": "DreamConsistency.RealmBootstrap.Cnsl",
"Service_UUID": "<stable-bootstrap-service-uuid>",
"ServiceInstance_UUID": "<environment-or-local-instance-uuid>",
"ApplicationScope": {
"Name": "Hestino",
"Application_UUID": "0d779f56-d39c-44f0-aa45-1d3b34e6e90a"
}
}
}
The service UUID identifies the bootstrap tool and remains stable.
The service-instance UUID identifies the concrete execution instance.
{
"DatabaseSettings": {
"RealmDatabaseConnection": "Server=...;Port=3306;Database=realmdb;User ID=...;Password=...;"
}
}
Secret rule:
Do not commit appsettings.Local.json.
Do not print the connection string or operator password.
¶ Execution Command
dotnet run --project .\DreamConsistency.RealmBootstrap.Cnsl\DreamConsistency.RealmBootstrap.Cnsl.csproj -- bootstrap-self-realm
When the terminal is already located in the project folder, the shorter form is:
dotnet run -- bootstrap-self-realm
The command prompts for the following values:
| Prompt |
Purpose |
| Expected database name |
Protects against executing against the wrong physical Realm database. |
| Environment |
Selects Development, Testing, Staging, or Production. |
| Realm UUID |
Stable UUID identity of the authoritative self Realm. |
| Realm name |
Human-readable self Realm name. |
| Realm description |
Optional environment and ownership description. |
| Core operator email |
Primary email address of the first privileged operator. |
| Core operator name |
Human-readable operator name. |
| Password |
Initial operator password, entered without being logged or displayed. |
| Confirm password |
Confirms the password before the execution plan is shown. |
The current minimum password length is 14 characters.
The configured maximum is 128 characters.
Before writing to the database, Bootstrap prints an execution plan containing:
- Target database.
- Selected environment.
- Realm UUID, name, and description.
- Core operator email.
- Required Foundation package and version.
- Required Foundation content hash.
- Initial Realm status.
The operator must type the selected environment name in uppercase to continue.
For Development:
Type DEVELOPMENT to execute:
DEVELOPMENT
Confirmation rule:
Review the complete execution plan before entering the confirmation token.
Cancel the process when any identity, database, environment, or operator value is incorrect.
A successful bootstrap creates:
- The authoritative self Realm in
INF_Realms.
- The Realm reference to the selected environment.
- The initial Realm reference to the
REGISTERED operational status.
- The first Core operator account and required account data.
- The securely hashed initial operator password.
Bootstrap does not create a session, token, cookie, or application login state.
The operator authenticates normally through the Management application after the required
platform and application provisioning has been completed.
The self Realm and first Core operator are created as one controlled Realm bootstrap operation.
A failure before commit must not leave a partially created bootstrap result.
- Foundation validation failure stops before runtime rows are created.
- Database identity mismatch stops execution.
- Schema contract mismatch stops execution.
- Password-policy failure returns to input validation.
- Duplicate or conflicting identities must be reviewed instead of forced.
- Unexpected failures must not print secrets.
Do not rerun blindly:
Realm Bootstrap is a one-time environment initialization tool.
After a self Realm or first operator has been created, inspect the existing records before
attempting another execution.
Additional operators are created through the normal Management account workflow.
Additional Realm records are created through controlled Realm registration and provisioning,
not by rerunning Bootstrap.
1. Deploy the Realm schema
2. Record SchemaVersion and ContractVersion
3. Install DreamConsistency.Realm.Foundation
4. Run DreamConsistency.RealmBootstrap.Cnsl
5. Install the remaining Realm catalogs
6. Install Management catalogs
7. Install Billing catalogs
8. Register applications and services
9. Validate and activate the self Realm
10. Start the product Management APIs and applications
- Rerun the Realm Foundation plan and confirm that all Foundation items are unchanged.
- Install the remaining Realm shared system catalogs.
- Install all Management shared system catalogs.
- Install all Billing shared system catalogs.
- Register the required applications, services, and runtime environment data.
- Complete self Realm validation and activation.
- Start Hestino Management services and authenticate using the first Core operator.
- No default administrator account is stored in source code.
- No default password is stored in source code or configuration.
- The password is never printed or logged.
- New passwords use the current secure Identity password hashing format.
- The primary email address is normalized before persistence.
- The expected database name must be verified before any write.
- Connection strings remain outside committed configuration.
dream-consistency
platform-tools
realm
realm-bootstrap
security
environment-provisioning
core-operator
dotnet
| Date |
Change |
Author |
| 2026-08-03 |
Created detailed Realm Bootstrap operational documentation after successful initialization
of the Hestino Development self Realm and first Core operator.
|
Branko |