One Host Holds the Pen

"Everyone can watch the valley. Only one person gets to write in the logbook."

Many eyes, one pen

A fleet has plenty of things that can observe — every Mac can report its own state, a probe can run from anywhere, a delegated agent can append events. Observation is cheap, and you want lots of it. But exactly one host — call it office — is allowed to write the fleet's control state: its policy, its membership, its operation ledger. Many eyes, one pen.

What two pens cost you

Let two hosts both write authority and you've bought a split-brain. One decides a laptop is retired; the other still lists it active and plans an operation against it. One starts an upgrade the other already started. Now every read has to ask ...according to whom? and there's no honest answer. A system with two sources of truth doesn't have two truths — it has none.

Observers are cheap, authority is not

So the split is deliberate: fan observation out as wide as you like, but funnel every authoritative write through a single owner. Peers that watch are witnesses — they report, and they never sign, synthesize, or write the canonical store. The logbook has exactly one author, and that is precisely what makes it trustworthy to everyone else reading it.

Even the tower is bound by this

The rule is strong enough to constrain the control-plane host itself: office cannot retire itself from the fleet while it holds the pen, because the instant it did there'd be no writer left to record the change. Moving the pen to another host is a real, verified operation with its own gates — never something that happens by accident. (You'll meet that migration again in the Membership track.)

Distribute observation, centralize authority. Two writers don't give you redundancy — they give you an argument no one can settle.

Code

Read from anywhere, write in one place·python

# Any host, any Pippa, any probe may READ fleet state:
state = watchfire.read(scope="fleet")        # cheap, safe, everywhere

# Only the control-plane host commits authoritative WRITES.
#   office : the single canonical writer of policy + operations
#   peers  : witnesses -- they observe and report, never write the store
op = watchfire.plan_operation(kind="retire_host", target="old-laptop")
watchfire.commit(op)   # refused unless THIS process is the canonical writer

# There is exactly one logbook, and it has exactly one author.
# That is not a bottleneck to optimize away; it is the property
# that makes every read trustworthy.

Exercise

Imagine two laptops both allowed to edit the same shared 'fleet status' note offline, then sync. Write the sequence of edits that ends with the two copies disagreeing about whether a machine is retired. Then decide: which copy is right, and how would a reader ever know?

Hint

There's no rule inside the data that picks a winner — last-write-wins just means whoever synced last, not whoever was correct. That hole is exactly what a single writer closes.

Many eyes, one pen

What two pens cost you

Observers are cheap, authority is not

Even the tower is bound by this

Code

External links

Exercise

Progress

Comments 0