23. The Walls Within Walls
Domain: Secure Architecture — Segmentation, Fail Secure, Resilience POV: Sable Reading time: ~15 minutes
The automaton backdoor had taught Sable something that no amount of logbook analysis or risk calculation could have taught her: a single compromise, if it reached the right system, could spread everywhere.
The compromised engineer had accessed only one control panel. The backdoor she had installed affected only one subsystem — the automaton control network. But because the automaton control network was connected to the gear-trains, and the gear-trains were connected to the clock synchronization system, and the clock synchronization system was connected to the Spire, a compromise anywhere in the network could propagate everywhere. The city’s infrastructure was not a collection of independent systems. It was a single, interconnected whole — and the interconnections, which had made the city efficient and resilient for centuries, had become its greatest vulnerability.
“We need to break the connections,” Sable said to the council. “Not all of them — the city cannot function if every system is isolated from every other. But the critical connections — the ones that would allow a compromise in one system to spread to another — need to be severed, or at least controlled. Every system should be able to operate independently, at least for a limited time, so that the failure of one does not mean the failure of all.”
“Segmentation,” Quill said. “The principle is ancient — older than the Citadel itself. Divide the network into segments, each one isolated from the others by controlled boundaries. If one segment is compromised, the compromise is contained within that segment. The adversary cannot move laterally from one system to another because there is no lateral path to move along.”
The segmentation project was the most disruptive thing the fellowship had ever attempted.
Every connection between every system in the city had to be mapped — not just the physical connections, the gear-trains and the signal-relays and the maintenance tunnels, but the logical connections: the procedures that allowed an archivist in the Library to request a document from the Archive of Record, the authorization that allowed an engineer in the gear-works to adjust a mechanism in the Spire, the communication channels that allowed the magistrates in the Inner Ward to send orders to the gate-guards at the perimeter walls. Thousands of connections. Hundreds of systems. A web of interdependence so complex that no single person had ever understood the whole thing.
Thread mapped the connections, because mapping was what Thread did. The map, when it was complete, covered an entire wall of the shed — a sprawling diagram of lines and nodes and annotations that looked, at first glance, like nothing so much as a city viewed from above, its streets and buildings and districts rendered in Thread’s precise, patient hand.
Sable and Quill worked together to identify which connections needed to be severed and which needed to be maintained. The principle was simple, even if the implementation was not: every system should be able to function, at least in a limited capacity, without depending on any other system. The gear-chambers should be able to operate independently of the Library. The Archive of Record should be able to function independently of the Spire. The residential districts should have their own water and power and communication, separate from the industrial districts and the administrative centers.
“Segmented but not isolated,” Quill said, as they worked through the endless lists of connections. “Each segment must be able to communicate with the others — the city cannot function if every system is completely cut off. But the communication must be controlled. Every message that crosses a segment boundary must be verified. Every request for access must be authenticated and authorized. The segments are separate, but they are not alone.”
“And the boundaries between them,” Sable added, “must fail secure. If the control mechanism that regulates communication between segments fails — if it is attacked, or corrupted, or simply breaks down — it must fail in a way that protects the segments, not a way that leaves them exposed. A door that fails open is worse than no door at all. A door that fails closed preserves the integrity of what is behind it.”
The fail-secure principle was tested, unexpectedly, three weeks after the segmentation project was completed.
A surge of corrupted gear-oil — the last remnants of the contaminated shipments that Wren’s audit had identified but not fully quarantined — reached one of the boundary controllers that regulated communication between the gear-chambers and the Spire. The controller, designed by Sable and Tessa to fail closed rather than open, detected the corruption in the gear-oil and immediately sealed the connection between the two systems. The gear-chambers were cut off from the Spire. The automaton workforce lost synchronization with the master beat. The assembly lines in the industrial district slowed and then stopped.
But the corruption did not spread. The Spire — the heart of the city’s timekeeping infrastructure — was protected. The gear-chambers, once the contaminated oil was drained and replaced, were able to resume operation independently, using their own local timekeeping mechanisms rather than the Spire’s master beat. The city was inconvenienced — production slowed, schedules were disrupted, the automata ran on backup timing for three days while the boundary controller was repaired — but the city was not crippled. The compromise was contained within the segment where it had occurred, and the rest of the city continued to function.
“It worked,” Sable said, reviewing the incident report with a quiet, exhausted satisfaction. “The segmentation contained the compromise. The fail-secure design protected the Spire. And the resilience of the individual segments — their ability to operate independently, even at reduced capacity — meant that the city continued to function while the damage was repaired.”
“Resilience,” Quill murmured. “The ability to withstand failure and recover. That is what we have been building — not just walls and barriers, but a city that can survive a compromise without collapsing entirely. A city where the failure of one system does not cascade into the failure of all systems. A city that can be broken in one place and still function everywhere else.”
Sable looked at the map on the wall — the sprawling diagram of connections and boundaries and segments — and understood, with a clarity that had been building since the moment she first noticed her kitchen clock was wrong, that the work they were doing was not just about defending against the Shroud or stopping Vale or surviving the current crisis. It was about building a city that could survive any crisis — a city whose architecture, in its very bones, was designed to contain damage and preserve function and recover from failure.
The walls within walls were not just barriers. They were a philosophy — a way of thinking about systems and failure and the inevitability of compromise. And that philosophy, more than any specific wall or barrier or door, was what would keep the city alive.