What Tinker Is — and What It Refuses to Be · Tinker Quest

"Watchfire owns observations; Pippa owns intent; Tinker owns the reversible action on this Mac." — the first paragraph of Tinker's architecture doc

The Missing Pair of Hands

By late 2026 the family had a lot of senses and very few limbs. Watchfire watched every Mac: CPU, disk, memory kills, simulators, Spotlight and iCloud activity. Haven ran the house: lights, TVs, the network. Pippa held the conversation and the intent — she could notice that Dad was about to edit video and know what would help. What nobody could do was reach into a Mac's own screen and change something there, safely, on purpose, with a way back. That gap is what Tinker fills. Its own doc calls it Pippa's permission-aware pair of hands on a Mac.

The word "hands" is doing real work in that sentence. Hands are not eyes: Tinker contains no process sampler, never runs ps or top, and asks Watchfire when it wants to know what the CPU is doing. Hands are not a brain: Tinker never decides that something should happen; a person or Pippa asks, and Tinker carries it out. And hands are not a house: Tinker acts only on the Mac it runs on, never on a lamp or a TV, and never on another Mac.

An Actuator, Not a Macro Language

The tempting design for a tool like this is a macro language: let the user script any sequence of UI actions, click here, type there. Tinker refuses that shape on purpose. It is a small set of typed capabilities, each of which knows how to prepare a change, apply it and undo it, and each of which must prove it can be undone before it is allowed in. A macro language can do anything and undo nothing. An actuator with typed, reversible capabilities can do little — at first, exactly one thing — and undo all of it.

The Sentence Under Every Rule

Every rule you will meet in this quest is a corollary of one sentence: undo only what you can prove you did. If an app was already hidden when Tinker arrived, Tinker did not hide it, so Tinker will not show it later. If the app quit and relaunched with the same process ID, it is a different process, so Tinker's old receipt does not cover it. If the machine crashed between "about to hide" and "hidden", Tinker cannot prove what happened, so it holds that record for review instead of guessing. Keep that sentence in mind and the rest of the design reads as consequences, not as a pile of special cases.

What It Looks Like

To Dad, Tinker is a hammer icon in the menu bar. The menu lists presets — editing, broadcast, drawing — and a Stop and restore everything item. Settings holds the presets, a shortcut recorder for every command, an Access & Recovery tab that lists every change Tinker currently owns, and an Activity tab with the last 200 requests. There is no desktop window at launch and no permission prompt on startup. To Pippa, Tinker is a set of app actions on a loopback door on whichever Mac she names.

Code

Who owns what — the four siblings around one change·text

Pippa      intent        "Dad is about to edit; hide the distractions."
Tinker     action        hide the preset's running apps on THIS Mac,
                          keep a receipt for each, restore only those
Watchfire  observation   WindowServer CPU / simulators / Spotlight / iCloud,
                          sampled before and after
Haven      the house     lights, TVs, network — never touched by Tinker

The shape of the idea: a change you cannot undo is not admitted·swift

// Simplified re-statement of Tinker's contract, not the shipped file.
protocol ReversibleAction {
    /// Describe what would change, before anything changes.
    func prepare(_ input: Input) throws -> [PlannedChange]
    /// Make one planned change happen.
    func apply(_ change: PlannedChange) async throws
    /// Take back exactly that change, if it is still ours to take back.
    func undo(_ change: PlannedChange) async throws -> UndoResult
}

enum UndoResult { case restored, noLongerApplicable }

Exercise

Pick a tool you use that changes your Mac's state (a window manager, a focus app, a script). For three things it can do, ask Tinker's question: if it did this and then crashed, could it prove afterwards which changes were its own? Write down which of the three it could undo honestly and which it would have to guess about.

Hint

Look for state that someone else could also have produced: a window that was already minimized, an app that was already hidden, a setting you changed by hand. Those are exactly the cases where a tool without receipts would 'restore' something it never did.

What Tinker Is — and What It Refuses to Be