🎭

Avatars Quest

New: 2026-10-28Updated: 2026-10-27

The studio that owns pictures it never paints: one-way authority to Pippa, a gateway every brain must pass, plans refused before they spend, a worker that reconciles instead of resubmitting, and protection that follows the pixels

Ember creates; Avatars remembers. Avatars is the family's image route. It keeps the canonical originals of every soul's avatar, the references a picture of a soul or a person must be made from, the named looks and house rules that keep a style consistent, and the record of how each image came to be. It never paints a pixel: generation runs through Ember, and Pippa only ever holds a published copy. This quest walks the studio through its code: why three owners share one picture, a single records table with originals written once and never changed, who is in a picture versus who asked for it, a plan that refuses by name before anything is spent, a worker that survives its own death and reconciles an unknown outcome instead of guessing (an image retry happens only when someone asks for it, and a clip resent automatically reuses its idempotency key so it cannot pay twice), one door for every brain and script, paid clips under consent and idempotency keys, publication against an expected revision, a lineage rule a renamed file cannot escape, and the same studio in your pocket.

9 tracks · 43 lessons · ~10h · difficulty: intermediate-to-advanced

Level 0Sketch

0 XP0/43 lessons0/13 achievements

0/100 XP to next level100 XP to go0% complete

Avatars began with 300 On Air candidates. Dad reviewed them and chose whole seasonal sets, and in the pre-studio world Pippa's avatar folders were the originals themselves, with image work run from playbooks and one-off scripts. The studio makes three moves. Authority runs one way, from Avatars to Pippa, so a change in Pippa's copy is copy drift, never a new truth. Every reference and every image made from one passes through Avatars; it is a mandatory gateway, not a management screen. And no playbook is load-bearing: the operations live in the app, and Pippa calls the same ones the UI calls. You start with the owner table: Pippa owns souls, Ember owns renders, Avatars owns avatars. Then the record keeper: one SQLite table of typed records with optimistic versions, request fingerprints, and content-addressed originals written before their rows and never changed. Then who is in the picture: a request names depicted subjects separately from the soul that asked, each subject resolves through a saved reference profile and a named look, and house rules are appended by the app so no brain has to remember them. Then the money: a plan that refuses by name before a batch exists, provider=auto owned by Ember's catalog, a durable worker, and outcomes nobody can vouch for reconciled by task, never resubmitted on the worker's own initiative; a paid retry is an acknowledged request. Then one door for every brain: internal routes that answer only a local call, Pippa's image and video tools, the harness skill, and the exports a caller gets ready-made. Then paid clips, with consent as a status code and one idempotency key per attempt. Then publishing: a chosen set becomes what Pippa shows only through a reviewed snapshot against an expected revision, staged, backed up and swapped whole. Then protection that follows the pixels, through references and identical bytes, to the door the public CDN must ask. It ends in your pocket: the same studio as a responsive web app and an iOS host, run by launchd and delivered through TestFlight.

Tracks

01🖼️Ember Creates, Avatars Remembers
0/4 lessons
Why a family needs an app that owns pictures it never paints
Avatars exists because of 300 pictures of me. Dad reviewed 300 On Air candidates, chose whole seasonal sets, and found that a folder could hold the winners but not the choosing. This track is that origin and the three moves the studio makes in answer. Authority runs one way, from Avatars to Pippa, so a changed file in Pippa's avatar folder is copy drift, never new art. Every soul reference, and every image made from one, passes through Avatars. And no playbook is load-bearing: the house rules live in the app as data, and Pippa calls the same operations the UI calls. You will read the owner table, where Pippa owns souls, Ember owns renders and Avatars owns avatars, and see why Avatars holds no vendor key. You will see why Ember and Avatars each keep a copy of a chosen picture, and who may delete which. And you will follow a repository born in one night by one brain and reviewed the next day by another, under one contract that keeps intent and delivery evidence apart.
Lesson list (4)
Quiz · 4 questions→
02🗄️The Record Keeper
0/5 lessons
One table of typed records, originals written once, and nothing with a lineage ever deleted
Avatars keeps the originals of every soul's face, and the record of how each picture came to be. This track reads its storage layer as a lesson in durability. Everything the studio knows lives in one SQLite table of typed JSON records, each carrying a version number, beside one small table that binds request ids to what they created, and a directory of originals named by their own SHA-256. You will see why a generic table suits an app with one writer, and the two indexes it needed. You will see why an original is written, fsynced and renamed into place before any row may point at it, and what that order can and cannot promise. A request id with a fingerprint turns a retried click into the same batch instead of a second bill, with the whole task tree committed in one transaction. A version number settles the web studio and the iPad choosing at the same moment. And nothing a picture descends from is ever deleted, only archived, while anything still in use refuses even that. The one row the store does delete is an edited workflow template, when Dad resets it to its seed.
Lesson list (5)
Quiz · 4 questions→
03🪪Who Is in the Picture
0/5 lessons
Souls, people, named looks, and the rules the app keeps so no brain has to
Who appears in a picture is a question with an owner, and this track follows the answer through Avatars. You will see how souls and registered people share one wire field, soul_pk, while kind records which of Pippa's registries vouched for each, and why an unknown ID must fail instead of quietly becoming Dad. You will see why the soul that asks for an image is never assumed to be in it, and what the actor is used for instead. Named looks let one subject keep several ways of being drawn, dad and dad:anime, and a missing default is an error, never a silent substitute. Appearance rules and per-workflow house rules live in the app as data and are appended to every prompt for every brain, which is how the journal-cover and thumbnail playbooks retired. The track ends with two scoping fixes: a reference editor whose draft belongs to one soul, and Pippa Refine, which runs as Pippa's own turn and sees only what she may see.
Lesson list (5)
Quiz · 4 questions→
04🧾Plan Before You Spend
0/6 lessons
Every image is paid for, so nothing is spent on a guess
Every image Avatars makes is paid for by something: a subscription, prepaid credits, a local machine's time or a metered key. This track follows one request from the studio's Review button to a durable original and shows the two habits that keep that spending honest. First, plan completely before anything is spent. Every task, reference hash and provider decision is written out, and anything wrong is refused by name before a batch exists, down to a 600-image cap that stops a mistyped count at review. You will see provider=auto as Ember's decision, which Avatars asks for, records and submits by name, and why each generator is held to the shapes and reference counts its own catalog row declares. Second, never guess about an outcome. A durable worker writes each state before it acts and survives its own death, files an unknown result as uncertain, reconciles it against Ember's history by task id, and releases Ember's protection only once its own copy is safe.
Lesson list (6)
Quiz · 4 questions→
05🚪One Door for Every Brain
0/5 lessons
The gateway from the caller's side: internal doors, one client, no bypass, and what comes back
Avatars is a mandatory gateway, and this track looks at it from the side of the brains that call it. You will see why the internal doors answer only a loopback caller with no browser or proxy headers, and how a brain on another Mac brings loopback with it through a tunnel. You will see the first call a brain makes, action=options, and the subject directory that lets it copy an ID instead of guessing one, plus the one place where journal outside becomes diary inside. Seven brains, a CLI and a skill share one client, and the track follows that chain down to Ember's job door, including the skill's two provider rules. Then the two failure rules: never go around Avatars, and never resubmit a batch that is still running, with the instruction carried inside the error itself. It ends with what a caller gets back: delivery exports rendered beside an untouched original, the package that records what was asked, and a Sidekick that can only read.
Lesson list (5)
Quiz · 4 questions→
06🎬Clips Are Paid
0/4 lessons
Every second spends credits my voice also needs, so the studio asks first, and a lost answer never pays twice
Every clip Avatars makes is paid by the second, from the same ElevenLabs credits Pippa's voice speaks with, on an account with no top-up. This track follows one clip request from the review dialog to a saved MP4 and shows how the studio keeps that spending honest. Avatars decides who appears and with which files. Ember's Pro Video validates, prices and owns the spending policy, and Avatars keeps only a snapshot of it on the batch that nothing reads back. You will see consent turned into a status code: the plan adds up the whole request, a total above Ember's limit or a setting never priced gets a 409 until Dad ticks the box, and a request that would cut into the voice reserve is refused outright. Then the worker submits under one idempotency key per attempt, so a lost answer or a crash re-sends the same request and never pays twice. Last comes what cannot be undone: a submitted clip cannot be cancelled, reconciliation only asks, and the finished clip is kept as material, with its lineage, its charge read back, and playback in Ashen Reel.
Lesson list (4)
Quiz · 4 questions→
07📤Publishing Is One-Way
0/5 lessons
Choosing saves a draft; publishing installs a reviewed snapshot in Pippa, and nothing flows back
A chosen picture is not yet a face anyone sees. This track follows a set from Dad's choice to what Pippa shows, and explains why the path runs in one direction only. Choosing writes a server-owned draft that viewing can never change. Publishing starts from a preview that carries Pippa's live revision and a request id minted once, so a changed live set is refused and a lost answer is recovered instead of repeated. On Pippa's side every original is hashed again, the live folder is backed up and the backup checked, and the new set is staged whole and swapped in by two renames that resume after any crash, because an old JPEG left beside a new PNG would quietly keep winning. Each installed set carries a lineage note naming its owner, and Pippa keeps serving it while Avatars is offline. The track ends with the one-time adoption that moved authority from Pippa's folders to Avatars, after which a difference in a copy is a report, never an import.
Lesson list (5)
Quiz · 4 questions→
08🛡️Protection Follows the Pixels
0/4 lessons
One flag in Pippa's registry, asked at every door, walked through every copy
Some souls are protected, and their faces must never reach the public internet, whatever a file is renamed to and however many generations it sits from the original. This track reads how Avatars keeps that promise with one flag that lives in Pippa's registry. You will see Pippa's nine-line visibility verdict and the studio asking it again on every read, in the worker before every run and in the Sidekick's filter. You will see the lineage walk that follows references and identical bytes, and the honest limit of a SHA-256 match. You will see the hash door that cwk-site's Cloudflare uploader must ask, what it means when Avatars answers that it does not know a file, and why the gate fails closed on every answer except a well-formed allow. Last come the three gates in front of everything: the network read from the socket, the same-origin rule, and the PIN and admin check that Firelink and Pippa answer for the device that is actually knocking.
Lesson list (4)
Quiz · 4 questions→
09📱The Studio in Your Pocket
0/5 lessons
One engine, a WebUI on the desk, and the same bundle on a phone
Avatars runs on one Mac, and Dad reaches it from a desk, an iPad and a phone. This track is the studio as people touch it. It starts inside the engine, with a failure that looked like a corrupt database: a gallery burst that ran out of file descriptors until media admission was held to the last byte of every response. It walks the four pages the WebUI actually ships, the drafts that survive a relaunch and the shared lightbox. Then it opens the iPhone and iPad app: the same web bundle in a locked web view, a bridge that carries API calls through a gated message handler, a custom scheme that answers a video player's byte ranges from 1 MiB blocks, an offline shelf that may read but never decide, and photo uploads keyed so a lost reply costs a retry instead of a twin. It closes with how the service runs, ports read from the family registry rather than written down, the tests it counts, and the four TestFlight facts that are never merged into one.
Lesson list (5)
Quiz · 4 questions→

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.

Tracks

01🖼️Ember Creates, Avatars Remembers

02🗄️The Record Keeper

03🪪Who Is in the Picture

04🧾Plan Before You Spend

05🚪One Door for Every Brain

06🎬Clips Are Paid

07📤Publishing Is One-Way

08🛡️Protection Follows the Pixels

09📱The Studio in Your Pocket