Made in the Shades¶

Before the move, and after it, three of the Home’s systems came from software houses in Ankh-Morpork that do not exist, and the move did not touch them, because the residents’ records, the donor ledger and the shared registry are not layers a charity swaps for a better-domiciled supplier. Covenant, the membership and supporter platform, is Golem Trust Computing’s. Bestiary, the resident management system, is Fabulist Systems’, in the Shades. The Great Ledger, the registry of known mythological entities, is run for the Circle Sea Creature Welfare Consortium by Cogsworth Systems. None of the three federates to anything. Each has its own door, its own contract, its own state of neglect, and a seat on the map that the scraps for this layer give once. After that the scraps ask what sits under the vendor, and who else can say no.

Covenant, read¶

Covenant holds the 200,000 members, donors, volunteers and supporters, the Adopt-a-Legend sponsorships, and the monthly letters about how a specific griffin is getting on. The Home is on the Professional tier, and the SAML integration that would put Covenant behind the identity provider is an Enterprise feature whose price has deferred the decision for two budget cycles, so Covenant keeps its own login, with MFA now required rather than optional, which the identity page records. The consultant’s administrator account from the original migration is gone, and the DPA, unreviewed since the Events module was added two years ago, has been reviewed and reissued to cover what Golem Trust now processes. The webhook secret that lived in a photograph is on the files page, and is rotated.

The other scrap is what sits under Golem Trust. Covenant’s own page says it is hosted on Golem Trust’s infrastructure in the Ankh-Morpork data district under its standard data boundary arrangement. Golem Trust’s own description says what the data district is: a converted fish warehouse near the Shades, with all infrastructure running on Hetzner Cloud in Finland, “a sovereign-sounding service that is itself run on someone else’s yard”. So the Home’s donor ledger, its files and its identity provider all sit, at the bottom, on the same German datacentre company, under three different contracts with three different landlords. That is no reason to move any of them, and it was not visible from the Home’s side until the vendor’s own page was read.

Bestiary, read¶

Bestiary holds the residents: intake, species, medical history, feeding, behaviour, therapy notes, rehoming, and the legal register of entities whose status no court has been willing to determine. It runs on a Windows Server 2016 in the comms room on the second floor, with local accounts, password resets by email through Kevin for eleven years, forty-seven accounts of which nine were suspended in a review eighteen months ago, and nightly backups to a share on the same physical server. Version 5, with a cloud-hosted option, has been coming soon since 2021.

Two things under it are real dependencies inside a fictional system, and they are Microsoft’s. Windows Server 2016 leaves extended support on 13 January 2027 by Microsoft’s own lifecycle page, after which the operating system under the residents’ records gets no security updates without an extended security update contract, and SQL Server 2016, if the database under it is of the same vintage, left extended support on 15 July 2026. So the on-premises system that was the Home’s least foreign dependency has an American operating system under it with a date on it, and the date is closer than version 5.

The Home wrote to Fabulist and asked three questions: what version 5’s cloud runs on, whether version 4.2.1 is supported on a newer Windows Server, and whether it runs on anything that is not Windows and SQL Server. The answers were coming soon, yes with an upgrade quote, and no. So Bestiary stays on the premises, on a newer machine that is still a Microsoft one, because the vendor gives the Home no other, and the scrap says so without dressing it up: the residents’ records sit on an American operating system by Fabulist’s choice, and that is the largest US dependency the whole move leaves standing. It stays because the alternatives are worse, a cloud in a location the vendor has not decided or a new resident system for 380 people, and it stays written down as a dependency kept. The day Fabulist answers the first question with a European cloud, or the day another resident system exists, the page changes.

The long road¶

There was no project to replace Bestiary, and the Bestiary page says why in one sentence: the support contract was renewed at a twelve per cent increase because there is no migration path that does not involve exporting eleven years of records in a format that Bestiary’s export function produces unreliably. That is a data problem before it is a software problem, and the premises page solved the first half of it without meaning to. Bestiary’s database is a SQL Server inside a virtual machine the Home now owns, so a nightly export straight from the database into plain tables runs beside the backup, and for the first time in eleven years the residents’ records exist somewhere Fabulist’s export function is not in the way. That export has been restored on a Linux machine and read. Until it had been, no replacement was real.

The second half runs beside Bestiary, not instead of it. Animal Shelter Manager is open source under the GPL, in Python on PostgreSQL, with a Debian package, and it is built for animal shelters, which for a Home whose intake question is whether the arrival eats people is close enough to be funny and far enough to need work on the species list. It runs in a Linux container on the same Proxmox host, loaded from the nightly export, and costs the Home nothing but Kevin’s time. Its job is to answer one question: whether the Home’s residents fit in somebody else’s schema.

The decision belongs to the people who use the records. Dr Flannel for the medical histories, Madame Zara for the behavioural schema she already has opinions about, Mrs Clodpull for intake, and the DPO for what eleven years of records may lawfully still contain. It is years, not months, and the Windows box with the label on it stays until they say so. A resident system for 380 people does not move in an afternoon, and the notes for this layer describe a move still under way.

The Great Ledger, read¶

The Ledger is not the Home’s to move. It belongs to the Consortium, is hosted by the Consortium’s partner Cogsworth Systems on infrastructure in Ankh-Morpork whose substrate Cogsworth’s pages do not say, and is reached through a web portal with accounts the Consortium issues. What the Home could put right, it did. The three former-staff accounts whose deprovisioning was requested fourteen months ago were chased until the coordinator confirmed removal rather than receipt. The Home’s primary contact in the Consortium’s records, a staff member who left eighteen months ago and whose forwarded mailbox the mail page closed, was changed to a role address that is read. The two amendments to the data sharing agreement that the Head of Programmes had been asked about twice were read, and accepted, and the acceptance is on file. The four rehoming discrepancies between Bestiary and the Ledger were corrected by hand, and the API integration scoped in 2022 stays deferred, so the next four will be found the same way.

The party that can say no here is not Cogsworth. It is the Consortium. The Ledger is shared, the Home is one member among many, and a member that stops meeting the agreement’s terms, or that another member’s government objects to, loses the registry that tells it whether an arriving chimera is who it says it is. That is a dependency no provider change reaches, and it is written down as one.

Whose seat¶

Three Ankh-Morpork vendors with three doors of their own, MFA required at the one that offers it, the DPA and the sharing agreement current and the dead accounts gone. The shared registry is named as the dependency it is. The residents’ records sit in a lockable room on a supported operating system that is still Microsoft’s, kept and counted.

What could go wrong?

• Hetzner closes its doors to Golem Trust and to the Home on the same afternoon, and Covenant is down with the Home’s files and identity provider, three contracts and one datacentre company.

• Fabulist folds before version 5 ships, and Bestiary runs unsupported on the last version that exists, on a machine the Home keeps patched because the vendor no longer can.

• The nightly export stops silently, and the long road is found to be two years shorter than it looked when somebody finally opens the candidate.

• The Consortium suspends the Home’s membership, and the Ledger goes dark for the Home while the other members can still see the Home’s residents’ histories.

• Microsoft’s date arrives and the machine under Bestiary is still the 2016 one, because the upgrade quote lost to the feeding budget.

The Consortium says no, what now? The Home keeps Bestiary, which holds everything the Home ever entered into the Ledger about its own residents, and loses what the other members entered about theirs. Intake goes back to the fax paper and the phone call to Genua. The dispute goes to the Head of Programmes and the Consortium’s legal team, where it was always going to go, and no server anywhere had a say in it.

Granny Weatherwax has never been to the Shades, and the Shades has heard of her anyway.