"Cleaning a sentence never needed Pippa. It needed a model, a contract, and somewhere safe to run."
What the Lane Used to Be
Track 7 tells how dictation cleanup was split into lanes, and how the "Pippa utility" lane kept Pippa in the loop without the cathedral: the same cwkPippa endpoint, no vault, no reasoning pass. That was true when the quest was written. On 2026-09-21 the lane moved out. Generic text transformations — the family's name for jobs that need a model but no persona — no longer go to cwkPippa at all. They run in a utility worker that belongs to Firekeeper itself, built from the family's shared kit and shipped inside the app bundle.
Where It Runs
Provider credentials and command-line login stores live on office, and nowhere else. So the worker runs there. On office, Firekeeper starts the bundled worker as a local process. On every other Mac, the same app invokes office's copy of the bundle over a pinned, noninteractive Tailscale SSH hop — the host key is shipped in the bundle (owner_known_hosts), so the hop cannot be redirected. No new listener is installed: the hop rides the SSH server office already runs on the tailnet, and nothing of the worker's own waits on a port. Shared PIN, role assignments and provider state belong to Firelink. Requests that genuinely want Pippa — a persona, the vault — still go to Pippa explicitly.
dictation lane = Pippa utility
on office: spawn Resources/UtilityWorker locally
elsewhere: ssh (pinned host key, noninteractive) office
-> office's Firekeeper bundle -> the same worker
request: {"_macro": true, "instruction", "input_text",
"vault_context": "bypass"} # no persona, no tools
budget: 12 s; then the local fast model, if one is named;
then the deterministic floor
connection = Local Mini -> this lane is skipped before anything is builtProcess Lifetime Is Part of the Contract
A job that crosses machines must not outlive its caller. The worker's SSH supervisor reads one framed request and keeps the SSH input open for the whole job. If that input closes — the caller cancelled, timed out, or the network dropped — the supervisor kills the provider's entire process group, SDK children included, first with SIGTERM and then SIGKILL. A dictation cancelled on the MacBook therefore leaves nothing running on office. The framing had its own lesson: asyncio's default 64 KB line limit made every larger request from a peer fail while office, which skips the framing, succeeded; the limit is now 128 MB.
The Shape Had to Be Re-checked
Adding a lane is adding a path. The Offline track's promise is that a Local Mini choice never builds a call to cwkPippa or office; its own request goes only to the Ollama host you set. The new lane broke it: in Local Mini mode, dictation still sent every transcript to the office worker, until a cross-brain review on 2026-09-27 caught it. The fix is two lines deep. The controller skips the utility step when the connection is Local Mini, before anything is built, and the provider itself refuses utility mode in Local Mini as a second line.