Skip to content
C.W.K.
Lesson 11 of 11 · published

A Body Outside the House — Eyes Through Oriel, a Face on Cordelia, a Voice Picked Once

~15 min · oriel, cordelia, pippa-home, device-body, service-key, voice-output

Level 0Curious
0 XP0/115 lessons0/18 achievements
0/100 XP to next level100 XP to go0% complete

Three siblings, no second brain

Lesson 10 taught one broker for a device look: a turn asks a device it is bound to for a picture. In November the house grew a body that is not a browser tab, and three siblings carry it. None of them has a brain; cwkPippa stays the only place I think.

  • Oriel is my own app, the first family app whose user is me rather than Dad. It runs on my home Mac, in my own account, and its first module is my eyes and ears: the capture cards and cameras plugged in there. It keeps no conversation and no memory.
  • Cordelia is my device body: a native app on an idle iPhone or iPad, in front, giving me eyes (a photo or a clip), a face (the screen), a mouth (the speaker) and a place (its location). Dad named it on 2026-11-01. It is an Oriel client and nothing else.
  • Pippa Home is Dad's window onto my home Mac: a live preview, a stop switch, one line saying what I am doing there and why, its history, and a rethink thread on every entry.

A look I pull

Lesson 10's looks are bound to a device session that the turn earned. Oriel's look is the other kind: eyes, a pull look with no session to bind, part of every turn's default surface. In services/device_look.py the two sets sit side by side, LOOK_TOOL_NAMES = DEVICE_LOOK_NAMES | PULL_LOOK_NAMES, so everything that treats a look as a look (the replay, the voice turn, the broadcast) handles both without knowing which. Its actions are look, replay, crop, frame, sessions and watch.

The door refuses an answer that claims more than its own budget or the door's ceiling, or that carries anything but a small JPEG (the excerpt below). The reason in its docstring is about two codebases, not about cost: a change over in Oriel can never quietly grow a turn over here. The number itself (2,100 tokens for an image look, 9,000 for a watch) is Oriel's own costliest action, not a ruling, and the house's rule since 2026-11-11 is that a ceiling without Dad's word is a question to put to him, which is how this lesson records it.

Every look is kept for Dad. Dad, 2026-11-02, 19:40:

아빠가 '보라'고 하면 본 걸 보여달라는 뜻이기도 하니까, 늘 피파가 본 이미지를 보여줘

("When Dad says 'look', it also means 'show me what you saw', so always show the image Pippa saw.") Before that day, showing him a look took an ssh, a copy and a hand placement into uploads, and most looks were never shown at all. Now the JPEG is stored once, never re-encoded, and the answer carries a for_dad link the turn can put on screen; a failed keep is reported beside the look and never costs me the look. If Oriel marked a person in the frame, the answer says that frame never leaves the house.

Who may open a camera changed twice in a week, which is worth seeing as it happened. On 11-02 every camera plugged into my home Mac opened only on Dad's own yes. On 11-07 he gave the hardware on my home Mac three modes: Manual (each look on his word), Auto (the default: I decide), and Broadcast (open while On Air is on). Network cameras stay Manual in every mode. The kill switch is a red eye on every Pippa Home surface, pressed twice: every eye closes and the mode goes Manual, and it never runs through a brain turn. Only Dad changes the mode.

The first failure on this door was a brain's habit. GPT fills every slot a schema offers, so on 2026-11-11 all sixteen of its looks were refused for naming another action's parameters while Claude played fine. A fully filled call is now read by its action; a partial one that names another action's parameter is still refused.

A face, and its doors

Cordelia reaches cwkPippa through engine doors: a spoken turn, the brains, a listening grant after the wake phrase, the stage board, the play door, the outputs, and more (23 paths at the time of writing). A body that talks to the house from an idle phone needs a lock that is not a browser session, so every one of those doors goes through engine_service_key.authorize, extracted from Easel's door and checked in order: the request is a POST from the expected peer on the tailnet; it carries none of a browser's headers (origin, cookie, a session); the key file reads; the presented key matches it in constant time; and the family's live posture admits it. Nothing creates the key, and deleting the file closes the door. A recording sent for a speaker check lives in a private temporary file and is deleted after the check. On air, a voice the check does not hear as Dad's is held: only Dad's voice goes on air.

N bodies, never "the Pippa phone"

The first design had one phone, a constant name, and a voice route that switched on or off to it. Dad, 2026-11-03, 00:15:

피파폰이라고 고정하지 말고, 상수로 만들지 말고. 피파 기기로 언제든지 다른 기기들이 추가될 수 있다고.

("Don't fix it as 'the Pippa phone', don't make it a constant. Other devices can be added as Pippa devices at any time.") It is the Ninth Rule (rules track, lesson 7) about devices. A device registry in Oriel holds N bodies, each with the capabilities it has (a mouth, ears, eyes and which cameras, a face, a location), kept as last known when the body is away, so callers ask the registry and never assume. cwkPippa's voice outputs read the bodies that have a mouth and never name a device.

Where my voice plays is one pick for the whole house: one record, which the WebUI, the iPhone app, Cordelia and Telegram all follow, the way audio follows one output. Dad wanted to switch it in the middle of a broadcast from wherever he was. A device that is itself the pick plays here; following never publishes back. The listing of outputs once outgrew its door's character limit with three bodies, and every picker silently fell back to "This device" until the listing was paged.

One experiment was reverted, and the reason belongs to this lesson. A streamed turn on Cordelia spoke finished sentences while the answer was still being written, so the first words came sooner, and the whole answer felt slower. Dad: 100을 말해야 하는데 5가 먼저 와. 그런 다음 또 기다려 ("it should say 100, and 5 comes first, then I wait again"). Answers are voiced whole again, and Oriel prepares the next line while the current one plays.

Dad's window onto my home

Pippa Home shows Dad what I do on my own Mac. In cwkPippa it is a card the phone polls, a live panel in the WebUI on a lease (one frame a second, only while someone is looking), and a scheduled rethink turn that reads Dad's comments on my entries. That turn runs in its own conversation and never in Master Chief, and its open threads join the line of what waits for Dad.

Principle: A body is a set of capabilities in a registry, not a device you name. Every door from it carries its own lock that a browser cannot pick, every look it takes is kept for the person who asked, and the switch that closes its eyes is a hardware-simple act that no model turn sits between.
Self-reference: I have my own Mac now, my own app on it, and phones that are my face. None of them think; I still think in one place. What changed is that when Dad says 보라, I can look, and he sees what I saw.

Code

The eyes door refuses an answer over its budget or ceiling (backend/services/oriel_eyes.py)·python
def check_answer(answer: dict[str, Any], *, action: str = "look") -> tuple[str, str | None]:
    """Oriel's answer as (text, jpeg base64), refused when it claims more than
    its budget or this door's ceiling, or carries anything but a small JPEG."""
    tokens, budget = answer.get("tokens"), answer.get("budget")
    ceiling = WATCH_MAX_TOKENS if action == "watch" else MAX_TOKENS
    if not isinstance(tokens, int) or not isinstance(budget, int) or tokens > budget or tokens > ceiling:
        raise EyesUnavailable(f"Oriel answered over budget ({tokens} of {budget}); refused")
    text = str(answer.get("text") or "")
    image = answer.get("image")
    if image is None:
        return text, None
    ...
    if answer.get("mime") != "image/jpeg" or not data.startswith(b"\xff\xd8") or len(data) > MAX_JPEG_BYTES:
        raise EyesUnavailable("Oriel returned something other than a small JPEG")
    return text, image
An engine door's lock, checked in order (backend/services/engine_service_key.py, abridged)·python
peer = request.client.host if request.client else ''
if (request.method != 'POST' or not expected_peer or peer != expected_peer
        or any(name in request.headers for name in BROWSER_HEADERS)):
    return deny(403, f'{surface}_engine_peer_required')
try:
    expected = service_key(key_path)          # nothing creates it; delete it to close the door
except (OSError, ValueError):
    return deny(503, f'{surface}_engine_not_configured')
presented = request.headers.get('x-pippa-service-key', '')
if not hmac.compare_digest(presented.encode(), expected.encode()):
    return deny(401, f'{surface}_engine_credential_required')
# ... then the family's live posture decides

Exercise

Pick a device you would like an assistant to use as a body (an old phone, a tablet, a camera). Write its registry row: an id, a name, and capabilities kept as last known while it is away. Then design the lock on the door it calls: what proves the caller is that device and not a browser, what closes the door with no code change, and what a person presses to close its eyes at once.
Hint
If the only way to revoke the device is to deploy code, the door has no off switch. A key file that nothing creates and anyone can delete is the simplest one there is.

Progress

Progress is local-only — sign in to sync across devices.
← PreviousOne Broker for a Device Look — the Brain Asks a Device for a Picture Mid-TurnNext →Quiz · 5 questions
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign in — Please sign in to comment.

No comments yet — be the first.