What is built
One twin works. It is small, and it is the right one, because it demonstrates the exact claim the rest of the primitive rests on: a twin here is a drop-in interface, not a dashboard. This page leads with it, then states honestly what else exists and what does not.
1. The working twin: the S3-compatible vault container built
"the container is a digital twin of S3, presenting the same S3-compatible API, so that code using boto3, the AWS CLI, or any S3 SDK believes it is talking to real S3, while the files are served from a vault, from local disk, or from memory, chosen as a swappable backend; the service's own code does not change."
Read that last clause again, because it is the whole exhibit. The service's own code does not change. Not "changes little", not "changes behind an adapter we wrote". The redirection is an endpoint change, and the AWS credential fields are reused to carry the container's own auth header, so an application that speaks S3 speaks to this instead without knowing.
| A twin, as defined here | A mock, or a simulation | |
|---|---|---|
| Who it is for | Production code, unmodified | Tests, usually |
| Measured by | Whether the client can tell | Fidelity to the original's behaviour |
| What is behind it | A real backend: vault, disk, memory, or S3 itself | Canned responses |
| Cost of switching | An endpoint | A code path |
| What it proves | Enterprise integration without integration work | That the tests pass |
This is why the container is worth more than its line count. It demonstrates stacking as well: real S3, a vault, or memory sit behind the same face and are selected per environment, which is the twin-of-a-twin structure made concrete rather than argued for.
Delivery evidence. The sg-compute analysis confirms the surface exists: Routes__Vault__Spec and the vault specs ship, with the docker packaging alongside. The container is sg-compute's to ship; this site's job is to explain why it counts as a twin rather than a compatibility shim. One loose end worth an hour is confirming the S3 face specifically in the current repository, as distinct from the vault specs it sits on.
2. The AWS twins, half-built and honestly labelled partial
The IAM configuration risk engine, from 5 July:
"it grounds each AWS object as a twin, an IAM policy, an S3 bucket, an EC2 permission, connected to reality the way the grounding ladder requires"
and it reuses "the existing Python codebase and the digital twins already built." It is real code: Python, unit-tested, producing JSON. What makes it a twin application rather than another scanner is a principle worth quoting on its own:
"the existence of a configuration is never itself a risk. A public S3 bucket is a fact and not a problem until you know what it holds."
Context, not configuration. The engine produces "evidenced, typed objects", and a separate rating layer does the rating. Facts come from twins; judgement happens elsewhere. That is the grounding ladder working as a pipeline rather than as a diagram, and it is the reason the output survives contact with an organisation that has ten thousand buckets.
3. The two established primitives primitive
Measure is grounded on a Twin
The ladder's bottom rung, cited across the estate. An observation that is not grounded is not a measure. Owned by risks. and standards.; the rung is this site's.
connected_to
"the connection from any node to a twin and onward to reality is connected_to." The established edge set ends here, which is what makes connectedness a property of the graph rather than of a document about it.
4. The ratio, stated
One working twin. One set of half-built twins. Two established primitives. A large designed layer covering the 2FA demo, the world-model simulation, the organisation twin and the agent twin, none of which exists. The primitive is load-bearing across five sites and demonstrated once.
Publishing that ratio is the credible move, and it is also a debt. Until G2 lands, the S3 container carries a great deal of weight on its own. The full built-and-designed table →
5. Licensing note
The content of this site is CC BY 4.0. The code discussed on this page, the S3 container and the AWS engine, is Apache-2.0, and that notice travels with it wherever it is reused.