Who can say no to the yard¶

Before the move, Golem Trust was the answer to the question its own customers were asking, and had not asked the question of itself. It is the party that can say no to the Home, the Royal Bank and the Patrician’s Office, the account that holds their compute, and it is itself a customer, with a short list of names that can say no to it. The scraps for this layer say what the first stack’s small print page says, turned around: the provider that answers to no one still stands on a handful of companies that answer over it, and being the floor for others does not put the provider on the ground itself.

The seven layers¶

Every layer this treatment touched, what it sits on, and who can say no to it. Cheery Littlebottom, who keeps the risk register, added the column she had wanted for years, the one for who sits above each supplier:

Seven layers where Golem Trust had drawn one, itself, and every row now setting the company above it beside the customers below.

The one name too many¶

Reading the “who can say no” column top to bottom produced one name more than once. Before the move Hetzner sat under the compute, the object storage and the backups, three entries and one company, which is the substrate page’s whole subject. The move put a second operator under the backups and disaster recovery, so Hetzner is no longer the answer three times over, but it is still the answer under the primary, and the floor is not level.

Downstream¶

The uncomfortable half of the table is the one the customers already drew. The Home’s move off its tenant found its files, its identity and its bank all resting on Golem Trust on Hetzner, on four contracts none of which mentioned the others, and the Home’s sector reading named Golem Trust as the sovereign-sounding service on someone else’s yard. From Golem Trust’s seat that is not an accusation, it is the job: it is the concentration the alliance already names as its single largest shared dependency, and reducing its own foreign layers does not make it less of one. What the move buys is that when Golem Trust has a bad morning, fewer of the reasons are American.

The floor¶

   who can say no to Golem Trust, after the move

   Hetzner ─────────── the primary (a second operator now under DR and backups)
   European DNS ────── the name's routing (Cloudflare gone)
   the mail relay ────── the alerts (Fastmail gone)
   the registries ──── the supply (mirrored, pinned, signed)
   Microsoft ───────── the Royal Bank's edge, the bank's to hold
   the licence owners ─ the captured tools (swaps piloted)
   the city ────────── the name

   and below all of it: everyone Golem Trust is itself the answer for

Seven layers each with the company above it written in, the one operator under three of them reduced to one and still there, the customer’s Microsoft edge bounded rather than owned, the captured tools on a schedule it controls, and its own place in the graph stated plainly: a floor for others that has, at last, found out what it stands on.

What could go wrong?

• A designation reaches Hetzner, and the primary stops for everyone Golem Trust hosts at once, while the second operator holds the encrypted copy the morning is rebuilt from.

• Two of the “who can say no” companies turn out to be one, sharing an owner, a bank or an upstream, and a row the table drew as separate was not.

• The firm reduces its own foreign layers and reads it as having reduced the concentration it is, which is a different problem no swap of its own touches.

• A customer’s edge, the bank’s Microsoft, becomes the way a designation reaches the customer through Golem Trust, and the boundary drawn on the identity page is the thing that has to hold.

Granny Weatherwax has stood on a great many things in her time and trusts the ground under her least of all, which is why she has always troubled to know what it is.