Cloudbase-Init

05-build-master.ps1 runs at every startup until the build is done. Flag files make each step run once; a persisted state file keeps true timings across reboots; a kill-switch flag makes a stray run a no-op. Then it cleans up, validates, publishes — and deletes itself.

One catalog request, one fully-built domain-joined Windows Server 2025 with a standard agent stack, a validation report, and no trace of the tooling that built it. The three-layer design — Aria/vRO control plane, cloudbase-init first boot, a pulled build engine — and the reasoning behind each seam.