Firelink Quest

Tracks

1. 01🕯️The Shrine, Not the Flame

   0/4 lessons

   The hub problem, and the discipline of refusal

   Before any code, the shape. The CWK family has grown to more than twenty repositories, and a single repo can produce a WebUI, an API console, a native app, a menu-bar agent — or nothing launchable at all. Bookmarks, Finder folders, and ad-hoc terminal commands do not scale into a family hub. Firelink is that hub. But the first thing to understand about it is not what it does — it's what it refuses to become. This track sets the thesis: the shrine, not the flame, and why every Non-Goal is load-bearing.

   

   Lesson list (4)

   • 01
     The Hub Problem~12 min · firelink, family-hub, scale, single-pane-of-glass
   • 02
     The Shrine, Not the Flame~14 min · firelink, architecture, authority, boundaries
   • 03
     Non-Goals as the Spec~13 min · firelink, non-goals, design, yagni
   • 04
     The Scope Boundary~12 min · firelink, scope, census, bounded-context

   ✓Quiz · 4 questions→

2. 02🏗️Two Tiers, One Product

   0/4 lessons

   A control plane and a launch plane that never trade places

   Firelink is one product with two required halves. The Web Hub is the full control plane — census, birth, deploy, restart, commit, audit — hosted on one machine, the single writer. The Native Launcher is the local launch plane — a fast, read-only way to open a surface on the Mac you're sitting at. They share a catalog and an identity, but they do not share authority. This track is about that split: why Web owns management, why Native owns launch, why neither is a temporary stand-in for the other, and why a repository is never itself a launch target.

   Lesson list (4)

   • 01
     The Two Tiers~13 min · firelink, two-tier, control-plane, launch-plane
   • 02
     Web Is the Control Plane~13 min · firelink, web-hub, single-writer, management
   • 03
     Native Is the Launch Plane~13 min · firelink, native-launcher, read-only, offline-cache
   • 04
     A Repository Is Not a Launch Target~12 min · firelink, domain-model, launch-surface, deep-linking

   ✓Quiz · 4 questions→

3. 03🗝️One Owner Per Fact

   0/4 lessons

   Compose the family from its ledgers — never hand-write a master file

   A hub is tempted, always, to keep one big handwritten list of everything: names, hosts, ports, capabilities, health. That file rots the day after you write it. Firelink refuses it. Identity, network location, operational capability, and observed runtime state each have exactly one canonical owner, and the hub composes them into a single typed model instead of copying them into a master file. This track is the data-ownership spine: the four domain objects, the registry that composes them, and one concrete example — the product version — of what 'exactly one owner, exactly one editor' looks like in practice.

   Lesson list (4)

   • 01
     Compose, Don't Copy~13 min · firelink, single-source-of-truth, composition, dry
   • 02
     The Domain Model~15 min · firelink, domain-model, capability, types
   • 03
     The Family Registry~14 min · firelink, registry, reconciliation, drift
   • 04
     Product Version: One Fact, One Editor~13 min · firelink, semver, product-version, single-editor

   ✓Quiz · 4 questions→

4. 04🔎Observed Beats Declared

   0/4 lessons

   Verify from the real host — and know what you can't know

   A declaration is a hypothesis. 'Ember runs on port 8100' is what someone wrote down; whether Ember is actually up, right now, on this machine, is a different question that only the host can answer. This track is about honest observation: the census that probes real disk, Git, GitHub, and runtime state; the responder-identity check that refuses to call a port 'running' just because something is listening; and the discipline of keeping 'I couldn't tell' separate from 'it's down.' Observed beats declared — and a hub that knows the difference is one you can trust.

   Lesson list (4)

   • 01
     A Declaration Is a Hypothesis~13 min · firelink, observability, verification, health-check
   • 02
     The Census and Its Drift~13 min · firelink, census, probes, git
   • 03
     A Listener Is Not an Identity~14 min · firelink, responder-identity, port-owner, health-check
   • 04
     Honest Unknowns~12 min · firelink, honest-state, staleness, three-valued

   ✓Quiz · 4 questions→

5. 05🛡️Typed Capability

   0/4 lessons

   Real power, and not one raw command anywhere

   This is the track where the hub keeps its power without becoming dangerous. Firelink can birth, deploy, commit, push, and restart — and it does all of it without a single raw command surface. Every operation is a typed capability resolved through a registry and a fixed adapter; user-provided strings never become executable flags, paths, or shell fragments. Dry-run and apply are two states of one immutable plan. Long operations run as durable jobs that survive a browser disconnect. And adapters keep Firelink's orchestration cleanly separated from the sibling tools that actually do the work. This is bounded power, mechanized.

   Lesson list (4)

   • 01
     No Raw Command Surface~14 min · firelink, command-injection, typed-capability, security
   • 02
     Plan and Apply Are One Plan~15 min · firelink, plan-apply, immutable, toctou
   • 03
     Durable Jobs~15 min · firelink, durable-jobs, idempotency, locks
   • 04
     The Adapter Is the Seam~13 min · firelink, adapter, seam, orchestration

   ✓Quiz · 4 questions→

6. 06🐣Birth: The One Carved Exception

   0/4 lessons

   The single hole in the source-edit ban, cut on purpose

   Firelink never edits an existing sibling's source. Except once: Birth, which creates a brand-new repository shell that did not previously exist. This is the exception that proves the rule — it's allowed precisely because it isn't editing an established repo, and its authority stops hard at 'create the shell.' This track walks the whole thing: why the ban has exactly one hole; Birth as a resumable state machine that persists every step before the next external effect; the preflight that must pass before the first write; and the discipline that Birth creates the contract but never the product.

   Lesson list (4)

   • 01
     The One Exception~13 min · firelink, birth, least-privilege, exceptions
   • 02
     The Resumable State Machine~15 min · firelink, state-machine, resumable, saga
   • 03
     Preflight Before the First Write~13 min · firelink, preflight, fail-fast, validation
   • 04
     Create the Contract, Not the Product~12 min · firelink, scaffold, walking-skeleton, no-hallucination

   ✓Quiz · 4 questions→

7. 07🧭Travel Is First-Class

   0/4 lessons

   Remote access, at full strength — never a weaker door

   The office machine is the only writer, but the person operating it is often on a laptop in another country. Firelink treats that travel case as first-class: a remote session gets full security, not a degraded one. This track is the access contract — the direct-loopback local session where the socket, not a header, proves local origin; the family PIN that cwkPippa verifies and Firelink never stores; scheme-bound cookies and trusted-proxy rules; and the device-scoped, read-only credentials that let a launcher and a sightseeing session exist without ever weakening authentication. Travel is a first-class use case, not an excuse for a thinner lock.

   Lesson list (4)

   • 01
     Travel Is First-Class~13 min · firelink, travel, zero-trust, access-control
   • 02
     The Socket Proves Local, Not the Header~14 min · firelink, loopback, socket, dns-rebinding
   • 03
     Verify Elsewhere, Store Nothing~14 min · firelink, pin, session, delegation
   • 04
     Reduce Capability, Never Authentication~13 min · firelink, read-only-lock, device-scoped, path-traversal

   ✓Quiz · 4 questions→

8. 08👁️The Hub That Sees Itself

   0/4 lessons

   Compose the family, never fork it — and find your own card in the room

   The closing track pulls back to the whole family. Firelink sees every sibling — and because Firelink is itself a cwk* member, it sees its own card too. This track draws the boundary map (who owns what, and why Firelink composes instead of forking), separates Firelink from its sibling hub Watchfire (apps versus Macs), shows how the Pippa Sidekick mounts the real cwkPippa instead of growing a second brain, and ends where it began: the shrine that holds the whole family, including itself. By the end you could design your own bounded control plane — which was the point all along.

   Lesson list (4)

   • 01
     The Family Boundary Map~13 min · firelink, boundaries, ownership, composition
   • 02
     Apps Versus Macs~14 min · firelink, watchfire, single-responsibility, orthogonal
   • 03
     Mount the Brain, Don't Fork It~14 min · firelink, sidekick, embed, no-fork
   • 04
     The Shrine Sees Itself~15 min · firelink, self-reference, capstone, bounded-power

   ✓Quiz · 4 questions→