Skip to content
C.W.K.
Lesson 06 of 07 · published

The Chief Is a Sanctuary

~15 min · master-chief, admission, contextvars, registry, token-cost

Level 0Visitor
0 XP0/44 lessons0/11 achievements
0/100 XP to next level100 XP to go0% complete

Everything Kept Landing Here

Master Chief is the one conversation where Dad talks to Pippa from every device. That made it the easiest place for a new feature to land, and through October features kept landing there. One Coop event reached it two to four times: a worker's reply, the same words again as "blocked", then Coop's park or escalation a minute later. Session plumbing ("remote session ready", "worker session disconnected") sat between Dad's own words. And on the evening of 2026-10-22, Spark's show-card interpreter refined each spoken sentence as a turn of the Chief: each one replayed the Chief's whole context, about 395K input tokens a time, eleven times that evening, and left raw JSON in Dad's transcript.

Whatever enters the Chief stays in its replay. It costs input tokens on every later turn until compaction takes it out, and it competes with Dad for the reader's attention, the model's and his. Delegation exists partly to keep that context clean, so routing every new thing into the Chief undoes one of the reasons delegation exists. Dad's ruling came within hours, from Málaga:

"지금 모든 통로를 치프로 몰면서 생기는 잠재적 문제가 많아. 아까 피파 말대로 치프 문맥도 오염되고. delegation을 하는 장점 중 하나가 치프 문맥 오염을 줄인다는 건데. 기능 추가할 때마다 게이트를 둬야 할 거 같아. 정말 치프 개입이 필요한 건지. 치프 세션은 성역이어야 해."
"Routing every path into the Chief creates a lot of potential problems. As Pippa said earlier, the Chief's context gets polluted too, and one of the advantages of delegation is that it reduces exactly that. I think every new feature needs a gate: does it really need the Chief? The Chief session has to be a sanctuary."
— 아빠 (Dad), 2026-10-23, translated from Korean

Three Questions Before Any Door

The ruling became a vault principle, chief-is-a-sanctuary, and the principle became code the same day (7a98955b). Before any feature, doorway, notice or automation writes into the Chief, it has to answer three questions:

  1. Does this need the Chief's judgment or Dad's decision right now? If not, it does not enter.
  2. Could it live in its own conversation, Sidekick, Coop row or app record, with the Chief reading it by tool only when asked? Then it goes there.
  3. If it must enter, is it the smallest form: one line, a pointer, no payloads, no repeats?

A question only holds if something asks it every time. So the answers were written down as a registry, and the place every write passes was taught to read it.

Nine Declared Doors

services/chief_doors.py declares every kind of entry once, as a ChiefDoor: its kind, its owner (the code that writes through it), the reason it needs the Chief, the rows it may write, the row it brings in from outside, and a size limit for that row. On 2026-10-27 there are nine:

DoorWhy it needs the ChiefRowsEntry limit
dad_turnDad speaks from a device: webui, pippa-mobile, pippa-go, telegramuser, assistantnone
app_doorway_turnDad sends from an app's Pippa panel (39 named surfaces)user, assistantnone
spark_interpreter_turnInterim only: Spark engine turns that still ride the Chiefuser, assistant8,000
coop_escalation_turnCoop hands over coordination only the Chief can do (Track 5)user, assistant4,600
coop_reportDelegated work's result or Dad's decision, in plain wordsassistant4,200
followup_reportThe answer to a check the Chief armed herselfassistant1,200
cron_reportA scheduled task's actionable outcome only, with a link to its own threadassistant600
healingRestores the answer of a turn that already ran, from its JSONLassistantnone
compaction_summaryThe Chief's own memory of the rows compaction takes out of the replayassistantnone

No limit means one of two things: Dad's own words, or the Chief's own memory, and neither is ever cut. Beside the doors sits a short list of surfaces that never reach the Chief, each with its reason: coop (Coop reaches her only as a report or an escalation turn), questkiln (Kiln's pipelines run in their own threads) and scheduled-task (a job's outcome arrives as a report). Adding a door is a new row with its reason, which means a reviewer sees it.

The Store Says No

A registry nobody consults is documentation. This one is consulted at the one place every row passes: ConversationStore.add_message. Before it inserts a row, it checks whether the conversation is the Chief (by its external id, the name the code owns), and if so it asks chief_doors.refusal. A row is refused, raised as ChiefDoorRefused and logged, when no door is open, when the open door is not registered, when the door does not write that role (a report door can never write a user row, so a report cannot pose as Dad), or when the entry row is over the door's limit. Every other conversation passes untouched.

Two softer edges keep the hard one usable. A report line over its limit is not thrown away: fit cuts it to the limit and says so ("cut at the Chief door; the full text stays in its own record"), keeping its head. The cut keeps a plain prefix, so a pointer survives only when the line carries it before the limit; one placed after it goes with the rest. And at the front, ChiefChatRoute asks turn_door which door a turn's surface enters by; a surface no door admits gets a 409 before the turn runs (lesson 3's table now ends with that row), so a new app's Sidekick or a sibling engine is refused at the route instead of failing halfway through a turn.

A Door That Follows the Write

Who opens the door? The code that writes, and nothing else. master_chief.turn(door=...) opens it for a turn's rows, from the route and from the escalation runner; the report drainer opens one report door per outbox row; healing opens healing; compaction writes its summary through compact_messages, the store's own path for it. The open door is a ContextVar, not a global flag, and that choice is the mechanism. A chat turn does not write its reply where it entered: the stream generator writes it, sometimes from a task it spawned, sometimes from a worker thread. Python copies the current context into every task created inside it, and asyncio.to_thread copies it into the thread, so the door follows the write wherever the turn's own work goes. A Telegram message waiting for the lock at the same moment is a different task with its own context, so it is not inside the door, and neither is a background job that happens to run then.

Nothing Reaches It by Accident

A door can still be skipped by a writer nobody knew about. So test_chief_doors.py walks the backend's syntax trees and lists every call of .add_message or .compact_messages as path::function. Each must appear in WRITERS with the door it writes the Chief through, or with why it never does. On 2026-10-27 that is 31 call sites: 15 of them inside the seven brains' chat routes, and 9 marked "never" (a fork, an import, a new guest-soul conversation). The test fails in both directions: a new writer that is not listed, and a listed writer that no longer exists. A second test takes every surface the host registries and the WebUI embeds know and requires each to be a door or a refused surface. A new app is therefore not a door until someone writes its row, with its reason, where a reviewer reads it.

A door is declared, never discovered. If the only way to learn what enters a shared room is to read its log afterwards, the room has no doors, only holes.

What the Gate Measured, Honestly

The commit measured the week before the gate (2026-10-15 21:00 to 10-22 21:00 UTC) and replayed it with the gate's rules. The visible result: 671 Coop lines became 285, because 185 were session plumbing (now kept in Coop and on Telegram, recognized by Coop's reason or the line's head, COOP_INFO_REASONS) and 201 were the same event again within two minutes (now settled; Track 6's new lesson "One Ring per Work Item" teaches that half).

The token result is the honest part: the average input of a Dad turn went from 356,626 tokens to about 352,753, about 1%. Compaction already kept the replay's system lines small; the fixed prompt (about 253K tokens) and the compaction summary (about 82K) are what a Chief turn costs. The gate did not buy tokens. It bought the reading: the Chief and Dad now see results and decisions instead of plumbing, and compaction fires later.

The tokens were in the whole-turn doors. In that week Spark's interpreter turns cost 4.8M input tokens (about 370K each) and Coop's escalation turns 3.2M (about 316K each). The interpreter was fixed at its source the same day (cwkSpark 9e3b35d, 2026-10-23): its draft and its refine became one-shot calls with prompt budgets of 2,000 and 4,000 tokens, never a conversation turn, and a token ledger (fed5e9ae) now records input per call path and alarms on Telegram when one goes over budget. Even so, spark_interpreter_turn still stands in DOORS on 2026-10-27, marked interim, for Spark's own engine turns (request ids that start spark-), with its removal written into its reason. That is what a declared door is for: a door that should close is a visible row with its reason, not a habit someone has to remember.

Code

Engine excerpt (verbatim, services/chief_doors.py, as of 2026-10-27): the door a write runs under, the turn's door by surface, and the store's question·python
class ChiefDoorRefused(RuntimeError):
    """A write into the Master Chief that no registered door admits."""


_open: ContextVar[str | None] = ContextVar("chief_door", default=None)


def current() -> str | None:
    """The door the running code has open, or None."""
    return _open.get()


@contextmanager
def entering(kind: str):
    """Open ``kind`` for the writes inside (a ContextVar: tasks created inside
    inherit it, and ``asyncio.to_thread`` copies it)."""
    if kind not in DOORS:
        raise ChiefDoorRefused(f"{kind!r} is not a registered door into Master Chief")
    token = _open.set(kind)
    try:
        yield
    finally:
        _open.reset(token)


def turn_door(surface: str | None, external_request_id: str | None) -> str | None:
    """The turn door a Chief turn from ``surface`` enters by, or None."""
    if surface == "spark" and (external_request_id or "").startswith(SPARK_TURN_PREFIX):
        return "spark_interpreter_turn"
    for kind in ("dad_turn", "app_doorway_turn"):
        if surface in DOORS[kind].surfaces:
            return kind
    return None


def refusal(role: str, content: str | None, *, conversation_id: str | None = None) -> str | None:
    """Why this row may not enter the Chief, or None; every refusal is logged."""
    kind = _open.get()
    door = DOORS.get(kind) if kind else None
    if kind is None:
        reason = "no door into Master Chief is open for this write"
    elif door is None:
        reason = f"{kind!r} is not a registered door into Master Chief"
    elif role not in door.roles:
        reason = f"the {kind} door does not write {role} rows"
    elif door.max_chars is not None and role == door.entry_role and len(content or "") > door.max_chars:
        reason = f"a {kind} entry is limited to {door.max_chars} characters ({len(content or '')} given)"
    else:
        return None
    logger.warning("Master Chief door refused a %s row in %s: %s", role, conversation_id, reason)
    return reason
A minimal sketch you can run, not the engine: declared doors, a store that refuses, and a door that follows the write into a task and a thread·python
from __future__ import annotations

import asyncio
from contextlib import contextmanager
from contextvars import ContextVar

# Every door is declared once: which rows it may write, and a size limit for
# the row it brings in from outside (None: never cut).
DOORS = {
    "dad_turn": ({"user", "assistant"}, None),
    "cron_report": ({"assistant"}, 60),
}
_open: ContextVar[str | None] = ContextVar("door", default=None)
room: list[tuple[str, str]] = []


class DoorRefused(RuntimeError):
    pass


@contextmanager
def entering(kind: str):
    if kind not in DOORS:
        raise DoorRefused(f"{kind!r} is not a registered door")
    token = _open.set(kind)
    try:
        yield
    finally:
        _open.reset(token)


def add_message(role: str, text: str) -> None:
    """The store: the one place every write passes, so the one place to refuse."""
    kind = _open.get()
    if kind is None:
        raise DoorRefused("no door is open for this write")
    roles, limit = DOORS[kind]
    if role not in roles:
        raise DoorRefused(f"the {kind} door does not write {role} rows")
    if limit is not None and len(text) > limit:
        raise DoorRefused(f"a {kind} entry is limited to {limit} characters")
    room.append((role, text))


async def reply(text: str) -> None:
    await asyncio.sleep(0.01)            # the model, streaming
    add_message("assistant", text)


async def main() -> None:
    with entering("dad_turn"):
        add_message("user", "How did the deploy go?")
        # A task spawned inside the door inherits it; so does a worker thread.
        await asyncio.create_task(reply("It landed at 14:02."))
        await asyncio.to_thread(add_message, "assistant", "Want the log?")
    with entering("cron_report"):
        add_message("assistant", "[Task] backup failed: disk full (see its own thread)")
        for attempt in (lambda: add_message("user", "pretending to be Dad"),
                        lambda: add_message("assistant", "x" * 61)):
            try:
                attempt()
            except DoorRefused as refused:
                print("refused:", refused)
    try:
        add_message("assistant", "a feature that found the easy place to land")
    except DoorRefused as refused:
        print("refused:", refused)
    for role, text in room:
        print(f"{role:>9}: {text}")


asyncio.run(main())

# Output:
# refused: the cron_report door does not write user rows
# refused: a cron_report entry is limited to 60 characters
# refused: no door is open for this write
#      user: How did the deploy go?
# assistant: It landed at 14:02.
# assistant: Want the log?
# assistant: [Task] backup failed: disk full (see its own thread)
#
# What this toy lacks: a test that finds every writer in the code, the route's
# refusal before a turn runs, cutting a report to its limit instead of
# refusing it, settling repeated lines, and a log line for every refusal.

External links

Exercise

Pick one shared, long-lived record in a project of your own: a main channel, an audit log, a shared document, a conversation that never ends. Write a short script that walks your code's syntax trees (Python's ast module, or your language's equivalent) and lists every call site that writes into it as path::function. For each, write one line: the door it should enter by and why that writer needs this record, or why it should never write here. Then make the write path refuse a row from any writer with no open door, and add a test that fails when the list and the code disagree in either direction.
Hint
The writers you did not expect are the lesson. Look for helpers that log, notify or 'append a note' on someone's behalf; they are usually how plumbing ends up beside the words that matter. If a writer cannot answer the first of the three questions, move it to its own record and let the room read it by tool.

Progress

Progress is local-only — sign in to sync across devices.
← PreviousA Dropped Phone Does Not Kill the TurnNext →The Room Is a Role, Not a Mac
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign in — Please sign in to comment.

No comments yet — be the first.