FC-0 — Physical & Virtual Substrate

Hardware lifecycle management · score 2, gap closeable, DAPM Delegated Included: Rancher lifecycles Kubernetes clusters and nodes through Cluster API. SUSE Rancher Suite tier (SUSE Virtualization): cluster upgrades move the SUSE Linux Micro node OS, the hypervisor stack, and storage as one orchestrated operation, with per-node pause-and-resume upgrade control — node OS lifecycle is genuinely integrated with workload management. SUSE Edge and SUSE Telco Cloud (separate SUSE product lines): Metal3 and Cluster API provide bare-metal lifecycle over Redfish BMC protocols — automated inspection, cleaning, provisioning, and deprovisioning — and Elemental provides node onboarding and OS lifecycle for edge estates. The boundary of the capability: no SUSE product manages firmware, BIOS, or BMC lifecycle. SUSE Multi-Linux Manager patches Linux estates but does not push firmware. OEM firmware tooling remains a separate management surface the enterprise operates alongside the platform. Closeable — firmware lifecycle automation requires acquiring and operating OEM or third-party tooling outside the SUSE boundary.

Substrate heterogeneity · score 2, gap structural, DAPM Retained SUSE Rancher Suite tier (SUSE Virtualization): runs on commodity x86_64 and ARM64 servers, with YES certification recommended rather than a strict component-combination compatibility list — enterprises can generally bring existing OEM estate hardware rather than purchasing certified node configurations. The hypervisor layer provides unified virtualization primitives across heterogeneous OEM hardware. Accelerators: NVIDIA vGPU and Multi-Instance GPU (MIG) support with automatic detection and hardware-isolated partitioning (MIG at the Suite tier; NVIDIA vGPU licensing is a separate NVIDIA relationship), and PCI passthrough for other devices. Gap from 3: accelerator management covers a single vendor family (NVIDIA), and OEM hardware management depth — firmware, out-of-band health — remains OEM-tool-specific beneath the unified virtualization layer. Bare-metal RKE2 with GPU operators is also a supported deployment shape for accelerated workloads — heterogeneity management is not bound to the hypervisor path alone. AMD accelerator support is in initial validation: AMD and SUSE began testing AMD inference microservices and enterprise blueprints on AMD Instinct MI350P in 2026. A validation effort is not a shipped product, so the productized accelerator path remains a single vendor family today. Structural — accelerator ecosystem breadth is an architectural scope constraint; this cell re-scores when a multi-vendor accelerator product reaches general availability.

Substrate portability · score 3, gap structural, DAPM Delegated Included: one Rancher management plane manages RKE2 and K3s clusters on-premises (SUSE Virtualization, bare metal), in cloud (RKE2 on cloud instances, plus imported EKS, AKS, and GKE under the same authentication, policy, and GitOps surface), and at edge (K3s, SUSE Edge) — the multi-cluster estate is one management boundary rather than per-substrate silos. The workload cluster stack runs across all substrate types without architectural change. Bounds stated honestly: SUSE Virtualization itself is on-premises only — VM workload portability is bounded to the on-premises estate, and cross-substrate portability lives at the Kubernetes layer. Gap from 4: the 4 anchor is reserved for cloud-native platforms where the hyperscaler is the substrate. Structural.

FC-1 — Distributed Data & Context Fabric

Data location and gravity awareness · score 1, gap closeable, DAPM Retained Included: SUSE Observability (250-node HA entitlement in the SUSE Rancher Prime subscription) provides programmatic, queryable topology and telemetry across the multi-cluster estate — clusters, workloads, and dependencies correlated in one model. SUSE Storage (Suite tier) exposes volume topology. This is infrastructure and storage awareness, not data awareness: no component knows what data a persistent volume contains or what regulatory classification applies to it, and there is no data catalog anywhere in the SUSE portfolio — no vendor data services estate exists to anchor one. A placement query asking where regulated data lives and whether a workload may access it from a given cluster cannot be answered by the platform. Closeable through third-party data catalog acquisition — a new vendor relationship and integration surface the enterprise owns.

Governance and compliance metadata · score 2, gap closeable, DAPM Retained SUSE Rancher Suite tier (SUSE Security): admission control, runtime enforcement, network microsegmentation, and compliance scanning against CIS, PCI DSS, NIST, and HIPAA frameworks at the infrastructure and Kubernetes workload level — and network-layer data loss prevention that inspects payloads in flight, a genuine data-adjacent enforcement capability. Kubewarden (certified Rancher project, add-on subscription) adds policy-as-code admission control. These governance capabilities propagate to workload admission and runtime enforcement. The boundary: none of it classifies or governs enterprise data — database records, files by sensitivity, SaaS system data — and no compliance metadata propagates to placement enforcement. Score 2 reflects genuine workload and infrastructure governance bounded at the data line. Closeable through data governance platform acquisition.

Retrieval and context services · score 3, gap opinion, DAPM Delegated SUSE AI Factory subscription required: purpose-built vector databases — Milvus and Qdrant — ship in the base SUSE AI Factory offering as AI Library applications, with out-of-the-box observability wiring into SUSE Observability, alongside vLLM and Ollama model serving and Open WebUI pipelines for retrieval-augmented patterns. One SUSE vendor relationship, no SI gate. Provenance stated precisely: AI Library registry applications are mirrored upstream projects with SUSE supply-chain attestation, supported at the product level within the SUSE AI Factory subscription — vendor-delivered open source with per-application support labels: SUSE-built applications are supported from installation through configuration to code fix, and SUSE-supported community applications receive installation and configuration support with code fixes flowing through upstream into the next release (vendor-confirmed, July 2026). Pre-validated blueprints — retrieval-augmented generation and inference-endpoint stacks assembled from SUSE Application Collection applications and AI components, in SUSE-curated and NVIDIA AI Enterprise variants — provide vetted starting assemblies. Gap from 4: this is not a managed RAG pipeline service — the enterprise deploys from AI Library and operates the retrieval stack itself. Opinion — applying what the subscription already contains, no new capability acquisition.

Data pipeline and lineage · score 2, gap closeable, DAPM Delegated SUSE AI Factory subscription required: MLflow and Kubeflow ship as AI Library applications — ML pipeline orchestration and experiment/artifact lineage for AI workloads, vendor-delivered and product-supported. For traditional data: SUSE Application Collection carries Apache Kafka as an attested, validated artifact — deployable within the SUSE boundary with artifact-level support — but an artifact is not a managed pipeline service, and this function requires managed pipeline capability: no SUSE product provides ETL, change data capture, streaming pipeline management, or enterprise data lineage. The profile is exactly the gradient's middle: ML pipelines present through the SUSE AI Factory subscription, traditional pipeline capability absent. Closeable — estate-scale pipeline and lineage capability requires platform acquisition outside the boundary.

FC-2A — Infrastructure Orchestration

Workload universality · score 3, gap structural, DAPM Delegated Included: containers orchestrated natively across the estate — RKE2 and K3s clusters plus imported EKS, AKS, and GKE under one Rancher plane with shared authentication, RBAC, and projects. SUSE Rancher Suite tier (SUSE Virtualization): VMs join through unified VM-and-container management in a single Rancher pane. Batch runs as Kubernetes Jobs; AI workloads run as Kubernetes workloads (SUSE AI Factory on RKE2). The architecture is federated — VMs execute on HCI clusters, containers on workload clusters, often provisioned as guest clusters sharing the same HCI capacity pool — with management unified above. No managed database service exists in the portfolio; databases run as workloads the enterprise operates. Gap from 4: shared pools and quota do not span workload types as a single scheduler, and GPU scheduling intelligence is partly held by the accelerator vendor. Structural — single-scheduler workload universality is not productized on-premises.

Resource lifecycle automation · score 2, gap structural, DAPM Retained Included: automated lifecycle within fixed capacity — Cluster API node provisioning, Rancher auto-provisioning RKE2 nodes as SUSE Virtualization VMs (genuinely elastic within the HCI pool), cluster autoscaler on cloud substrate, SUSE Storage replica management. VM Auto Balancing (utilization-based VM redistribution) is early access and not scored. Delivery model, which is part of this score: SUSE sells self-managed software on customer-owned hardware. SUSE Rancher Prime Hosted and SUSE Observability Hosted Prime host management planes only — there is no managed hardware consumption offering with pre-staged capacity. On-premises capacity is bounded by owned physical nodes; the physical supply chain remains outside the platform's control. Structural — the on-premises operating model constraint.

Policy and quota enforcement · score 3, gap opinion, DAPM Retained Included: estate-wide RBAC — one authentication and role surface enforced across every managed cluster, including imported EKS, AKS, and GKE clusters, so policy authority extends across control planes the enterprise does not host. Projects apply resource quotas across namespaces; Fleet distributes policy and configuration declaratively at fleet scale with drift detection. Kubewarden (certified Rancher project, add-on subscription): policy-as-code admission control with a policy library. SUSE Rancher Suite tier (SUSE Security): admission and runtime security enforcement. Gap from 4: enforcement layers — admission, network, runtime — are configured per layer from included primitives rather than propagating from a single policy engine. Opinion — the enterprise configures consistent enforcement using what the subscription contains.

Substrate lifecycle integration · score 2, gap closeable, DAPM Delegated SUSE Rancher Suite tier (SUSE Virtualization): maintenance mode live-migrates VMs before node maintenance; integrated upgrades move node OS, hypervisor, and storage as one orchestrated operation with per-node pause-and-resume control; Kubernetes node health drives workload rescheduling; SUSE Storage rebuilds replicas on node failure. Gap from 3: no hardware-event layer — out-of-band hardware health telemetry (IPMI, Redfish) does not feed scheduling or update decisions during operations. SUSE Edge's Metal3 inspection is provisioning-time, not operational. Firmware lifecycle sits entirely outside the platform (see FC-0 F1). Planned maintenance evacuates workloads correctly; what is missing is the substrate health signal informing the control plane's decisions. Closeable — hardware-event integration requires acquiring and integrating OEM management tooling.

Accelerator and GPU management · score 3, gap opinion, DAPM Delegated SUSE Rancher Suite tier: NVIDIA vGPU and Multi-Instance GPU (MIG) support on SUSE Virtualization with automatic detection and hardware-isolated partitioning (NVIDIA vGPU capability is also delivered in-boundary through SUSE AI Factory with NVIDIA, which embeds NVIDIA AI Enterprise into the SUSE offering, generally available July 2026, with NVIDIA AI Enterprise certification extending to SUSE Linux Enterprise Server; standalone NVIDIA vGPU licensing otherwise remains a separate NVIDIA relationship). Included in SUSE Rancher Prime: NVIDIA GPU Operator validated on RKE2, backed by RKE2's CNCF Kubernetes AI Conformance certification — independently validated GPU device plugin integration, gang scheduling, and high-performance networking — and Virtual Cluster GPU multi-tenancy via K3k (GA): isolated Kubernetes control planes on shared GPU infrastructure in shared GPU mode, with per-virtual-cluster GPU usage restriction as the documented quota mechanism. The platform provides hardware-enforced partitioning plus a shipped multi-tenancy and quota layer. Gap from 4: scheduling intelligence — topology-aware placement, fair-share queueing — remains with NVIDIA components or enterprise-applied upstream tooling rather than native platform scheduling. Opinion — advanced patterns are configured from validated primitives already in the boundary.

FC-2B — Execution & Runtime

Runtime universality · score 3, gap structural, DAPM Delegated Included: containers execute across the RKE2/K3s estate; batch runs as Kubernetes Jobs. SUSE Rancher Suite tier (SUSE Virtualization): VMs execute as KubeVirt custom resources — kubectl-manageable, Kubernetes-native API surface. SUSE AI Factory subscription: AI inference runs as Kubernetes workloads with OpenAI-compatible endpoints. Every workload type speaks the Kubernetes API — the developer toolchain is consistent in kind across the portfolio. The structural shape: workload types execute in separate cluster domains — HCI clusters for VMs, workload clusters for containers, often as guest clusters on the same HCI capacity — unified at the Rancher management layer rather than sharing one cluster boundary. Gap from 4: a single execution surface spanning all workload types in one namespace and scheduler is not productized on-premises. Structural.

Persona abstraction at execution · score 3, gap opinion, DAPM Retained Platform-gap versus opinion-gap, stated explicitly: the primitives exist and are complete; the shipped opinion covers some workload types. Included primitives: Rancher projects and RBAC separate developer and operator personas across the estate; K3k virtual clusters give developers an entire isolated Kubernetes control plane while operators retain the substrate — control-plane-grain persona separation, a stronger isolation unit than namespace scoping; Fleet separates application-team GitOps from infrastructure configuration. SUSE Rancher Suite tier: SUSE Virtualization VM templates and instance types abstract substrate details when operators pre-configure them; SUSE Security provides the security-audit persona surface at runtime, and SUSE Observability (included) provides estate-wide operator visibility. The opinion gap: turnkey separation is shipped for container workloads through the Rancher UI and project model; VM workloads expose more network and storage substrate to developers unless operators pre-configure templates. Opinion — configuration of existing primitives, no acquisition.

Execution lifecycle and observability · score 3, gap opinion, DAPM Ceded Two components scored together, per the function definition. Telemetry exposure: standard formats across the estate — Prometheus, OpenTelemetry, OTLP — including out-of-the-box OpenTelemetry instrumentation for SUSE AI Factory components (Ollama, Open WebUI, Milvus). Correlation layer: shipped in the base subscription — SUSE Observability (250-node HA entitlement with SUSE Rancher Prime) is a dedicated topology-correlation platform, correlating topology, telemetry, and traces across the multi-cluster estate in one model, with an AI agent surface over it. Buyer situation, per the function's discipline: for buyers without an observability platform, the correlation layer is included rather than a separate acquisition; for buyers with one, standard-format telemetry integrates as configuration. Gap from 4: correlation across VM guest interiors and AI surfaces requires configuration and agents, and the enterprise operates the observability platform itself — it is software in the subscription, not a managed service. Opinion.

AI inference and agent execution · score 3, gap opinion, DAPM Delegated SUSE AI Factory subscription required: model serving is platform-native in the base offering — vLLM and Ollama from AI Library, Open WebUI as the serving front end, LiteLLM as the model-API proxy layer (API keys, multi-provider routing, cost tracking), mcpo for MCP-to-OpenAPI bridging, MLflow for model lifecycle, and out-of-the-box AI observability into SUSE Observability. Universal Proxy — centralized MCP endpoint governance — is tech preview and not scored. Gap from 4, and the within-band character stated plainly: governance depth (token quotas, showback, gateway policy) comes from applying LiteLLM, a mirrored-upstream component inside the supported stack, rather than from a shipped governance product; inference auto-scaling is Kubernetes-native (HPA/KEDA) rather than serverless. Opinion — the components are in the subscription; the enterprise configures the governance depth it needs.

FC-2C — The Reasoning Plane

Autonomous placement reasoning · score 0, gap structural, DAPM Retained What exists: Kubernetes scheduler primitives (affinity, taints and tolerations), Fleet's cluster-label targeting for GitOps placement at fleet scale, Kubewarden admission policies, SUSE Virtualization VM scheduling (VM Auto Balancing, early access, is utilization rebalancing, not policy reasoning). The Liz agent crew (GA) correlates live estate signals and executes operations through governed MCP interfaces with human approval. Applying the derivation test to a concrete scenario — a new GDPR residency requirement arrives: the constraint enters through a human, because no data-classification plane exists to receive it programmatically (see FC-1); the operator translates it into Fleet cluster selectors, Kubewarden admission policies, and network segmentation rules; the platform dispatches those rules exactly as written. Liz can assist — draft the policy, audit drift, correlate violations — but with human approval, as operator tooling. The constraint-to-rule translation remains the operator's job. This is rule dispatch executed well, not derivation. The agentic layer is genuine scaffolding at the operations tier — agents consuming live topology and acting on infrastructure through governed interfaces — but operations assistance is not placement reasoning, and the gap is doubly structural: the reasoning plane is absent, and the FC-1 governance metadata it would consume is also absent. Structural — no product with a confirmed timeline addresses placement derivation from governance metadata.

FC-3 — Application Distribution and Governance

Application catalog and distribution · score 3, gap opinion, DAPM Delegated Included: a supply-chain-first catalog. SUSE Application Collection (Prime tier, approximately 141 applications) delivers curated applications as coherent units — base image, runtime, application, Helm chart — with signatures, SBOM/VEX, SLSA Level 3 provenance attestation, and subscription- and service-account-gated consumption. Rancher Apps & Marketplace provides Helm-based deployment with repository control. SUSE Rancher Suite tier (SUSE Private Registry, Harbor-based): the enterprise's own governed publication surface — RBAC, scanning, signing, retention. Kubewarden (certified Rancher project, add-on subscription) closes the consumption loop by enforcing signature verification at admission. VM images are governed at the SUSE Virtualization image and template level; AI components distribute through AI Library (SUSE AI Factory subscription). Gap from 4: this is a chart-and-image catalog — strong publication governance with thinner day-2 operational intelligence, Helm upgrades rather than operators encoding application-specific operational knowledge; traditional applications inside VMs are governed at the image level, not the application payload. Opinion — extending governance uses registry and admission primitives already in the boundary.

Application lifecycle governance · score 3, gap opinion, DAPM Delegated Included: Fleet GitOps, first-party and fleet-scale — declarative application lifecycle with every change Git-tracked, drift detected, and reconciliation logged: audit trail as architecture. One engine spans the entire estate — the same GitOps lifecycle governance applies to every managed cluster and workload type rather than separate per-product lifecycle domains, which is what earns the score. SUSE Application Collection provides version streams with chart comparison for upgrade evaluation. SUSE Rancher Suite tier: Harbor-based retention and immutability policies in Private Registry; SUSE Security provides runtime compliance drift detection. Rancher audit logging records management-plane actions. Gap from 4: no channel-based deprecation and retirement semantics for catalog content, and unified audit across all application types in one correlated surface requires SIEM integration — configuration against standard audit telemetry. Opinion.

Developer experience and self-service · score 3, gap opinion, DAPM Delegated Included: self-service deployment from the Rancher catalog within project RBAC and quota guardrails — approval is platform policy, not a ticket queue. K3k virtual clusters as self-service units: a developer receives an entire isolated Kubernetes control plane on shared infrastructure, a coarser and cleaner self-service grain than namespace vending. SUSE Rancher Suite tier: VM self-service through the unified Rancher pane. Rancher Developer Access (separately purchased subscription): SUSE Application Collection integrated into Rancher Desktop with zero-CVE images — workstation-to-production artifact continuity. SUSE AI Factory subscription: AI self-service through Open WebUI and AI Library. Gap from 4: no internal developer portal product — golden-path platform engineering (a Backstage-class portal) is enterprise assembly — and the self-service grain varies across workload types. Opinion — consistent entry points are configured from included primitives.

AI application and agent distribution · score 2, gap closeable, DAPM Delegated SUSE AI Factory subscription: AI components distribute through AI Library and Helm with supply-chain attestation — governed distribution through general-purpose mechanisms. Model versioning exists as an applied component: the MLflow model registry within the SUSE AI Factory subscription, and Ollama model management. What is absent is a productized AI-specific governance surface: no model catalog shipped as a product with RBAC and token quotas, no agent tool authorization, no prompt-injection controls, no AI output audit trails. Universal Proxy (tech preview, not scored) targets MCP connection governance — an integration-layer capability, not distribution governance. Score 2: distribution via general-purpose mechanisms without AI-specific audit. Closeable — partial hardening is available by applying MLflow and admission primitives, but AI-specific governance at the next band requires capability no SUSE subscription currently contains.

FC-4 — Integration Fabric

Event fabric and messaging · score 1, gap closeable, DAPM Delegated No event fabric product exists in the SUSE portfolio. What the boundary provides: Apache Kafka and NATS ship as SUSE Application Collection artifacts — attested images and charts validated on RKE2, with artifact-level support inside the one-vendor boundary. Deploying them yields messaging the enterprise operates; it does not yield a managed event fabric — schema governance, filtering, fan-out, dead-letter handling, replay, and delivery guarantees as operated capability remain enterprise-built on top of the deployed components. The artifact tier sets the floor at 1 (messaging components available within the vendor boundary); the managed-fabric capability is Closeable — reaching it requires either acquiring a managed streaming platform from a different vendor or building and operating the fabric layer as an enterprise capability.

API management and gateway · score 2, gap opinion, DAPM Delegated No API management product exists in the SUSE portfolio. What the boundary provides: Apache APISIX — an API gateway with authentication, rate limiting, and transformation capability — ships as an SUSE Application Collection artifact, and Traefik Gateway API is the supported ingress path on RKE2 with long-term support. This is a gateway component, enterprise-operated: the gateway function is real and in-boundary, with artifact-level support. Gap from 3: no productized API lifecycle — publication workflow, developer portal, versioning governance, and API analytics as vendor-operated capability; the enterprise assembles these from APISIX's own feature set and operates the result. Opinion — the component is already in the subscription and the enterprise applies it; support is artifact-level, and the operational lifecycle of the gateway is the enterprise's own.

Workflow and process orchestration · score 0, gap closeable, DAPM Retained No workflow or process orchestration capability exists anywhere in the boundary. Fleet is GitOps continuous delivery, not process orchestration. No workflow engine ships in any SUSE product or in the SUSE Application Collection. The Liz agent crew executes operational tasks with human approval and is not a business-process engine. BPMN-compliant business process orchestration — long-running transactions, saga patterns, compensation logic, human task management — and AI agent chain orchestration require acquisition entirely outside the SUSE boundary and enterprise operation of the result. Closeable.

SaaS and enterprise system integration · score 0, gap closeable, DAPM Retained No connector library exists in the SUSE portfolio — no maintained connectors to ERP, CRM, HCM, mainframe, or SaaS systems of record, and no integration framework product. Every system-of-record integration is enterprise-built and enterprise-maintained, with the enterprise absorbing upstream API changes itself. This is the most operationally expensive absence in the row: each cross-system governance gap carries its own multi-year build-and-maintain burden. Closeable through third-party integration platform acquisition — the same path available on any substrate, credited to none.

AI-native integration · score 2, gap vendor-roadmap, DAPM Delegated SUSE AI Factory subscription, GA today as applied components: LiteLLM provides model API federation — multi-provider routing, API keys, quotas — and mcpo bridges MCP servers to OpenAPI endpoints; both are mirrored-upstream components inside the supported stack that the enterprise configures. Adjacent but not credited here: the GA MCP server embedded in SUSE Rancher Prime and SUSE Multi-Linux Manager exposes platform operations to AI agents — an operations-management surface, not an application integration fabric. The named roadmap product: Universal Proxy — centralized MCP endpoint management, automated server discovery and registration, smart traffic routing, cost control, and shadow-AI discovery — is in tech preview. Score 2 reflects the GA component layer: AI-native integration patterns available through in-boundary components without managed connection infrastructure. Vendor roadmap — a specific product in confirmed development addresses the managed-infrastructure gap; GA would move this function toward 3, re-scored on evidence at that time.