"A settings file that remembers which brain to use will be right on the day it was written."
From a Field to a Slot
When this quest was written, the brain behind command mode came from two fields in Firekeeper's own settings.json: pippaBrain and pippaEffort. Every Mac carried its own copy, and Firelink, the family's control tower, had no way to see or change them. On 2026-08-13 Firekeeper joined the family's Brain Control Plane. Command mode and explicit Full Pippa dictation now resolve one central assignment, the slot firekeeper/full_pippa_command, at the moment a job starts. Voice chat got its own slot, voice_chat, six weeks later. The two old fields survive only as the snapshot used the first time Firekeeper registered.
job starts (command mode, or Full Pippa dictation)
-> resolve firekeeper/full_pippa_command (brain, effort, model pin)
ok -> run with exactly that
unavailable -> FAIL CLOSED: skip Full Pippa,
fall to Local Mini (then deterministic for
a dictation; nothing inserted for a command),
say so on screen
never: guess from settings.json pippaBrain / pippaEffortFail Closed, Visibly
"Fail closed" here means the job does not invent a brain. If the assignment cannot be read, Full Pippa is skipped for that job and the remaining ladder runs, and the status chip says what happened — the substitution with Local Mini became visible in the same week the slot shipped. The voice chat's slot is stricter still: no assignment, no talk, and the panel names the reason. A brain that silently differs from the one shown in Settings is the failure this whole design exists to prevent; voice chat had exactly that bug, showing one brain while running another, until it got a slot of its own.
Who May Write
An assignment is family state, so who can change it is part of the design. Writes and enrollment happen on office (This Mac) or in Firelink. Another Mac over Tailscale can read the live assignment, with the PIN, but cannot change it. Local Mini is not a slot at all; it is the absence of cwkPippa. And Firekeeper must never re-register from a second Mac, because registering rotates the app's key. The slot also carries its model pin — until a 2026-09-27 review found the pin never reached the voice turn, every brain quietly ran its admin default.
The Family Owns the Authority, Too
In September the same move reached authentication. The PIN that unlocks cwkPippa over Tailscale had been a plain string in settings.json — a file that rides the office-to-peer sync and the NAS backups, so one PIN had become nine copies plus history. It now lives in the Keychain, and the session token in memory only. PIN issuance and role assignments moved to Firelink through the kit's authority resolver, and a single PippaDoor became the one owner of the session header, re-authenticating once on a 401 for every path alike.
The Default Knows Which Mac It Is On
The connection default had the same disease in a different organ. Every Mac defaulted to "This Mac" and localhost, which is right only on office. On the MacBook, port 8000 belonged to a different family app entirely, so command mode and voice chat reached the wrong server until someone set Tailscale by hand. Since 2026-10-06 the default follows the machine: the vendored KitFamilyHome reads the fleet label, office gets This Mac on loopback, and every other Mac gets Tailscale preset to office's tailnet address — still an editable field. A stored "This Mac + loopback" on another Mac reads back as the remote default; any other stored choice stays. Off office, Settings offers This Mac only while it is the stored choice.