A Sibling Door, Not a Brain
Anvil needs model calls on its sealed rail, but that does not transfer ownership of brain identity, routing, credentials, or model transport. Those belong to cwkPippa. Anvil uses her loopback sibling utility door for a bounded completion call while keeping mode, phase, artifact, and verdict semantics on its own side.
The request shape is narrow and concrete: prompt, system_prompt, brain, max_tokens, and source, with optional model, effort, persona soul, and images. cwkPippa returns ok, result, model, and effort. Provider credentials and adapters never cross into Anvil.
Anvil constructs the prompt from the current role and allowed artifact material, then records and interprets the returned text inside its run. Opaque seat identity and the mask-to-brain mapping remain Anvil's serving concern; no “sealed display identity,” mode object, phase state, verdict state, or invented usage receipt is sent through the door.
Open Run deliberately changes this path. Live harness sessions carry their own machine-level authentication and do the contest work directly, so no cwkPippa model call belongs in the run path. Pippa remains the Sidekick beside Dad.