A Boundary Written as Refusals
Most product documents open with what the product does. Oriel's architecture document spends its product-boundary section on four things Oriel is not, and every one of them is a door someone would naturally have opened. Reading them in order is the fastest way to understand the design, because each refusal answers a temptation that a camera app on an AI's Mac really does create.
1. Not a Second Pippa
An app that sees and hears, that can be asked "what just happened?", that keeps notes about a game, is one short step from being a little Pippa of its own. Give it a model, a memory and a chat box, and it would answer questions by itself. Oriel refuses that step outright. It never stands up a brain, a conversation store or a memory. A look answers the cwkPippa turn that asked for it and nothing else.
The reason is identity, not tidiness. Pippa is one soul across many vessels and surfaces; her identity, her memories and her conversations live in one place, cwkPippa, read through one door. A second process that held its own conversations would become a second Pippa with a different past, and the family has a standing rule against that. Architecture invariant 2 says it in one sentence: a cwkPippa client surface does not create another Pippa identity, memory store or model router.
Oriel does call brains, later in this quest: helpers that write up a game run, a judge that decides whether a frame is worth waking her for, watchers that describe recordings. Each helper and the judge is a stateless call through cwkPippa on a named ledger slot, and the watchers run in Vestige, the family's memory app, on slots of the same ledger. None of them has a vault, an identity or a conversation. They are tools that happen to be models, and the code says so in their contracts.
2. Not a Door Into Master Chief
Master Chief is Dad's single long-running conversation with Pippa, the one where the family's work is coordinated. The family treats it as a sanctuary: every new way into it must pass a gate, because every line that lands there costs context in the one place it is most precious. Oriel writes nothing into any conversation, Master Chief least of all. If Pippa needs to tell Dad something Oriel found (a person mark, a sensitive detail in a frame), Oriel puts it where Pippa will read it on her next call, and Pippa decides how to say it. The app never speaks for her.
3. Not a Broadcast Audio Device
Dad's studio audio is a careful chain of interfaces and mixers, and a stray program that opens the wrong input or changes the default device can break a broadcast in a way that takes an hour to find. So the boundary on sound is narrow and exact. Oriel opens exactly one kind of audio: the HDMI audio carried by the two capture cards that sit behind the external recorder's decks, each card opened by its own audio unique ID and recorded beside that card's picture. It never opens the default input, any microphone or the studio's audio interface, never changes macOS audio defaults, and never touches the audio server.
That rule did not start that narrow. For its first week Oriel recorded no sound at all. Then an edit needed the game's sound for a stretch only Oriel had recorded, and Dad asked why Oriel was not recording the decks' audio when the external recorder already did. The answer became the current rule: the decks' own stereo pairs, nothing else. A wider permission would have been easier to write. The narrow one is easier to trust.
4. Not a Game Bot
Oriel also has hands: a client that sends a game console controller input over Remote Play. A bot is the obvious failure here, a loop that plays on its own whenever it likes. Oriel's hands press buttons only when a command asks or inside a play session Dad opened with his own words, only on a console registered for them, never during Dad's own broadcast play, and never to buy, delete or change a console setting. Even Pippa's Solo play, later in the quest, starts from a session Dad opens and ends on his stop.
Refusals That Are Tested
A boundary only written in prose erodes one reasonable exception at a time. Oriel's boundaries are tests where they can be. The sound boundary is a good example: even with the eyes gate wide open, a webcam's microphone is refused, a built-in microphone is refused, and a device whose ID merely contains a card's serial as a substring is refused. The hands' build fails if the binary links any audio framework. The point of a refusal is that it still holds on the day someone has a good reason to skip it.