A working drawing set

Five plates that carry the whole design.

Each plate is one sheet from a working set. Move between them, then break a dependency to see which record still stands.

Boundaries

Trust boundaries

Trust boundaries are physical, not conceptual. A boundary is a wall with named doors. Deny cross-zone by default. Allow only documented flows.

Select a dependency to see what still holds when it breaks.

Plate 03, Trust boundariesTrust boundaries are physical, not conceptual. A boundary is a wall with named doors. Deny cross-zone by default. Allow only documented flows. A top-down plan of three rooms. Edge on the left has a thin wall and contains a TLS terminator and a remote-access mesh. Private core in the middle has a thick wall and contains compute, identity, and network. Data on the right has a thick wall with a lock on its door and contains a storage pool. An optional AI annex with a dashed wall sits beside the core. Door labels name the allowed flow at each opening. A bottom stripe states the default policy: deny cross-zone, allow named dependencies, log denies with consequence.PLATE 03BoundariesTrust boundariesREV 2026-07UNTRUSTED, EPHEMERALTRUSTED, MAINTAINEDIRREPLACEABLE, RECOVERABLEOPTIONAL ANNEXPUBLIC INTERNETEDGETHIN WALLTLS TERMINATORpublishes,never authorizesREMOTE ACCESS MESHno admin portsexposed to the internetPRIVATE CORETHICK WALLCOMPUTEcontainers or VMsone owner per servicepatched on a scheduleIDENTITYOIDC authoritybreak-glass sealedrecovery is independentNETWORKresolver, ingress routing, policytwo resolvers on independent domainsOBSERVABILITYreachability, host health, job heartbeatsthe alert path lives outside this zoneDATATHICK WALL, LOCKEDSTORAGE POOLintegrity, snapshots, recovery sourceDISK 1DISK 2DISK 3The encrypted copy lives elsewhere.See Plate 04 for the recovery chain.AI ANNEXOPTIONALUnplug withoutlosing household servicesSeparate power domainfrom Core443/tcp, HTTPS onlyTLS SNI requireddocumented portsstateful return onlydocumented CIDRservice accounts onlyunix socket, read-onlyDEFAULT POLICYDeny cross-zone. Allow named dependencies. Log denies with consequence.Keep the management plane inside Private Core and reachable only from the mesh above.FLOW LABELS SIT ON PAPER CHIPSTHE LOCK MARKS AN IDENTITY BOUNDARYTHE DASHED WALL IS OPTIONAL

Plate 03, Boundaries

Trust boundaries

Trust boundaries are physical, not conceptual. A boundary is a wall with named doors. Deny cross-zone by default. Allow only documented flows.

  1. EDGE, THIN WALL

    The TLS terminator publishes, it never authorizes. The remote-access mesh exposes no admin ports to the internet.

  2. PRIVATE CORE, THICK WALL

    Compute, identity, and network sit here. Two resolvers on independent domains so neither is a single point of failure.

  3. DATA, THICK WALL AND A LOCK

    Storage pool with a documented CIDR and service accounts only. No shared credential with the application.

  4. AI ANNEX, DASHED WALL

    Optional. Unix socket into core, read-only. Unplug it and household services keep working.

  5. DEFAULT POLICY

    Deny cross-zone. Allow named dependencies. Log denies with consequence. Keep the management plane inside core.

  1. 04-networking
  2. 06-security
  • ● verified or healthy
  • ▲ degraded or needs attention
  • ■ failed dependency

Plate 03

Trust boundaries

Scroll or drag to move across the drawing. Pinch to zoom on touch devices.