"The hub that refused to fork a brain now arranges where every brain sits — and still owns none of them."
The Family's Minds, on One Wall
Every sibling app that does Pippa work has a brain assignment — which brain sits in its app-work slot. Those definitions and assignments live in cwkPippa's Brain Control Plane, and for a long time the only way to see them was to go there. The Brains tab puts the whole matrix on the hub's wall: every brain definition and every member's slot, composed at request time from cwkPippa's registry, its assignment matrix, and its read-only admin settings, laid over the family registry snapshot. And per one-owner-per-fact, Firelink persists almost nothing about any of it — exactly one artifact, its own admin key, minted locally and locked to owner-only file permissions. The brain facts stay with their owner; the hub borrows them live.
The honesty rules from track four hold here too. Retired brain rows are shown flagged as retired, never silently dropped. Members with no slot are named explicitly, not hidden. And if cwkPippa can't be reached, the tab says so — it does not cache the last good matrix and wear it as fresh. An unreachable brain owner is an honest unavailable, the same posture as the vitality overlay.
Compose the Write Path, Too
The Sidekick lesson was the read case: mount the brain, store nothing. The Brains tab is the harder case — it mutates. Changing an assignment, creating or restoring a snapshot: all of it forwards to cwkPippa's own admin-scoped routes, behind Firelink's write gates, against office ground truth. Nothing writes to a Firelink copy, because there is no Firelink copy. Two guards make the writes safe. First, revision checks: every assignment change carries the revision it was read at, and a conflict surfaces as an honest 409 — the edit is refused, never silently overwritten. Second, safety nets: a restore or an applied recommendation captures an automatic snapshot centrally, in the same transaction, so the way back is always already there. Even deletion is shaped: snapshot deletion is its own armed destructive control, removing exactly one snapshot without touching the live assignments or their revision.
And every mutation lands in Firelink's local audit ledger as its own typed action — brain.update, brain.snapshot, brain.restore, and their siblings — so the hub's answer to 'who changed which brain where, and when?' is a lookup, not an investigation.
A Recommendation Is Not a Command
The boldest piece is the quietest. cwkPippa's current main-driver Pippa can generate a recommendation — a proposed reassignment the family might want. It is inspectable, it is explainable, and it never auto-applies. A human reads it, judges it, and applies or discards it — and both of those endings are audited too. One brain is deliberately out of the recommender's reach: Gemini is never a recommendation target (a metered-API decision, locked by Dad), though a human can still assign it by hand. The machine proposes; the family disposes.
And the fallback order every family engine walks — try this brain, then that one — is declared in exactly one place: Firelink's own family brain chain, a small config file treated as hub policy the same way the operation registry is, served read-only to every consumer. Notice who owns what, because it's this whole quest in miniature. The brain definitions and assignments belong to cwkPippa. The chain declaration is hub policy — a fact no sibling ledger owned, so Firelink owns it. The engines read the chain as the base of their own role chains and overlay only their role knobs. One owner per fact, sorted by who actually owns the fact.