The slow way, made survivable Chapter 20 of 23 Svenska

The map · Part Two · The machine · Chapter 20 of 23

The boundary

One file served, every other path refused. The folder behind the server holds dozens of private files. The difference between one file exposed and all of them is a single block of configuration, and removing it would expose everything silently. About 5 minutes.

Chapter 19 got a page to the phone. This chapter is about the two words "a page", because the server that hands it over sits in a folder full of things that must not travel.

The one-path boundaryLeft: a grid of forty small hatched file icons with one blue icon among them, labelled: one file is served, every other file stays behind the line. A thick wall. Right: the server's one rule, slash goes to the page, anything else goes to not found. A green arrow for a request for slash reaches the server; a dashed vermillion arrow for anything else is crossed out before it. the reports folder: dozens of filesone file served: the overview pageevery other file: research, records,daily runs — stays behind the linethe server's one rule:"/" → the pageanything else → not founda request for /a request for anything elsethe rule is one block of configuration; remove it and every filein the folder is served, and nothing would alarm
The server knows one address and answers every other with 'not found'. The folder behind it holds dozens of private files. The difference between one file exposed and all of them is a single block of configuration.

What is in the folder

The page is written into the reports folder, beside every nightly report, the shadow book, the record of sales, the pre-purchase notes for names being considered, and the research briefings. On the day the tunnel was built, the folder held 93 files. All but one are the owner's private research, and several of them are precisely the documents whose contents the whole method is built to protect from being seen early: the owner's growth views and reasoning.11deploy/TUNNEL-NOTES.md, THE BOUNDARY: 'reports/ held 93 files on 2026-09-13'.

The rule

The server has one rule with two halves. A request for the root address is answered with the overview page. A request for any other path, anything at all, is answered with "not found" and zero bytes. That is the entire published surface: one address.22Verified 2026-09-13 after the last fix: a request for the root returned the page; a request for one of the other files in the folder returned 404 with 0 bytes; the only listening address on the machine was the loopback one; a request to the public name without a login was redirected to the front door.

Why one block of configuration matters

The rule is a few lines in the server's configuration file. Remove the half that says "everything else: not found", and the server's default behaviour takes over, which is to serve whatever file the request names. Every file in the folder would then be one address away, behind the same front door but no longer behind anything else. Nothing would fail. Nothing would alarm. The page would keep loading exactly as before. The ruling names this: "That block is the boundary; the deployment notes say so, and any change to it is a ruling, not a merge."33Ruling F1, limb (b), WHAT THIS COSTS.

This is the general shape of a boundary worth worrying about: a constraint whose removal changes nothing visible. The three bugs found during the build were all of this kind. The server bound to every network interface for three minutes, and nothing complained. A missing directory made the server restart seven times, and only the notifier's repetition revealed it. A configuration line in the wrong form made the server answer every request from the relay with a blank page of zero bytes and a success code, because the line doubled as a filter on which requests it would answer at all.44deploy/TUNNEL-NOTES.md, 'Three bugs found during the build — all fixed'. Each was found by testing the thing directly, not by waiting for an alarm, because none of them would have raised one.

The security literature has a name for the principle the block enforces, and it is fifty years old: every program should operate using the least set of privileges necessary to complete the job.55Saltzer and Schroeder, 'The Protection of Information in Computer Systems', 1975. The server's job is one file. Its privilege is one address.

Decided
The server answers one address with one file and everything else with not found. The block that enforces this is named as the boundary, and changing it requires a ruling.
Why
The folder holds the owner's private research. A default file server would expose all of it with no visible change.
Cost
A configuration whose regression is silent. The only defence is a written rule that changes to it are rulings, and a test that asks the server for something it must refuse.

Sources for this chapter

  1. Saltzer and Schroeder (1975), The Protection of Information in Computer Systems
    https://www.cs.virginia.edu/~evans/cs551/saltzer/
  2. The boundary, as recorded — read from this repository: deploy/TUNNEL-NOTES.md; deploy/vss-overview.service; reference/FRAMEWORK-EDITS.md F1 limb (b)

The slow way, made survivable. Built 2026-09-13 from the repository as it stood that day. NAME A and NAME B are fictional; no company, price or holding appears on this site. Not financial advice: one private investor's method, shared as it is.