"All the scary verbs live in one room, and that room has exactly one writer."
Everything That Changes State Lives Here
The Web Hub is the full management body of Firelink. Every operation that changes anything lives in this tier: the complete managed-app catalog and drift reconciliation; disk, Git, GitHub, roster, network, version, and runtime health; read-only Git inspection (fetch, log, diff planning); commit and non-force push of files already on disk; new-repository birth from the template; registered native-app and repository-tree deploy adapters; registered service restart; durable operation plans, runs, results, and audit; favorites and filters; family PIN entry through cwkPippa; and the Pippa Sidekick mount.
That's a big surface. And per the shrine rule, that's allowed — the Web Hub is meant to be comprehensive. Its constraint isn't feature count; it's authority. It may orchestrate all of this, but it can't absorb the implementation each operation ultimately runs.
Office Is the Only Writer
Here's the load-bearing sentence for the whole tier: office is the only writer. Every mutating operation executes against office ground truth, on the one machine that hosts the engine as a launchd-owned process. This isn't about where the browser is — it's about where the write happens. A travel browser on the tailnet can drive every operation, but it drives the office engine; it never becomes a second writer with its own copy of state.
That single-writer discipline is why the control plane can be trusted. There's exactly one place where a commit, a deploy, or a roster edit actually occurs. No merge conflicts between two hubs, no 'which copy is right?', no split-brain. The browser is a remote control; the office engine is the only hand that touches the family.
Comprehensive, Under One Lock
Concentrating every mutation in one authenticated place is what makes 'comprehensive' safe. If birth, deploy, commit, and restart were scattered across clients, each client would need the full security posture and each would be a place things could go wrong. Instead there's one guarded door. The Web Hub can afford to do a lot precisely because it does all of it from a single, authenticated, single-writer position.