# Concepts

> Architecture, security, and state boundaries.

---

LLMS index: [llms.txt](/ainfra/v0.1/llms.txt)

---

These pages explain why `ainfra` separates project configuration, contracts,
infrastructure state, host configuration, and workload deployment.

---

Section pages:

- [Architecture](/ainfra/v0.1/docs/concepts/architecture/): Tool ownership, public contracts, and lifecycle boundaries.
- [Security model](/ainfra/v0.1/docs/concepts/security-model/): Threat assumptions, enforced invariants, and verification layers.
- [Project configuration and locking](/ainfra/v0.1/docs/concepts/project-configuration/): Committed desired state and generated template provenance.
- [State and secrets](/ainfra/v0.1/docs/concepts/state-and-secrets/): Backend requirements, secret references, and recovery.
- [Template strategy](/ainfra/v0.1/docs/concepts/template-strategy/): How ainfra turns versioned template source into reviewable infrastructure.