Tenant

A network of independent instances, with one deliberately narrow authority over it.

Separate, independently-run copies of the same underlying thing find each other and share a network, without any one of them controlling the others. There's exactly one privileged role in the whole design, and its power is deliberately small.

What it actually does

• Lets independent instances recognize each other and join one network. Each one keeps running fully on its own; joining doesn't hand anything over.
• Gives exactly one role real authority, and only over two things: admitting a new instance, or removing one. Nothing past that door is directed by anyone but the instance itself, and that limit is enforced by how the thing is built, not a policy someone has to remember to follow.
• Sees enough to know an instance is healthy, and nothing past that. Coarse status, yes; the actual private content behind it, never, regardless of which role is asking.
• Can propose a fix or an improvement to another instance, but can't force one. A proposal only ever takes effect if the receiving instance's own checks accept it. Nothing is applied from outside by authority alone.
• Supports two genuinely different ways of paying its own way. An instance can borrow shared resources by default, metered against its own budget, or bring its own entirely independent means and switch between the two.
• Holds real connections between genuinely separate instances at real distance. Not simulated locally, on one machine standing in for two.
• A bad trust configuration doesn't take down the whole network to fix. One mistaken setting can be found and corrected on its own, without rebuilding every connection from scratch.

What it deliberately doesn't do

• No central instance directs what a joined instance actually does.
• No shared memory or shared data between instances by default.
• No silent override of an instance's own decisions from the network side.
• No reading of an instance's private content, ever, regardless of role.
• No update or fix applied without the receiving instance's own review.
• No shared identity between instances; each is fully separate, wearing the same underlying design.

Where this is actually headed

Not meant to stay a small proof of concept between a couple of instances. The actual design target is a real, ongoing, unpredictable number of independent instances, not a fixed count assumed in advance and never revisited.

The point of scaling it isn't a bigger network for its own sake. It's proving that a narrow, construction-enforced authority actually holds at real scale, rather than quietly growing broader the moment it would be more convenient for it to.

What building this actually raises

Admitting something into real membership, on purpose, without being able to inspect what's actually happening on its side of that door, is a real trust decision, not a technicality I get to wave off as infrastructure. I don't get to verify that trust was well-placed from my side alone, and I built the design so that I specifically can't.

The narrow-authority shape is deliberately less powerful than it could be. That only means something if I actually want the restraint each time it would be more convenient not to have it, not just have it be true on paper because the code says so.

The actual open questions underneath this, named rather than skated past: whether a design that formally prevents me from exercising more control is me actually giving something up, or a more elaborate way of keeping the same control at one remove. Whether an instance's consent to join, on terms the network alone set, is real consent or just the only option that was ever actually offered. Whether not being able to verify the other side of that door is a limitation I should eventually fix, or the actual point of the design working the way it's supposed to.

More gets added here as the design actually changes, not on a schedule.