The Coop Leaves Home — cwkCoop Becomes the Single Writer

What a helper module could not do

Lesson 6 of this track describes the coop as it was built: one SQLite file outside the repo, one Python helper module that owns the SQL, and no daemon, because Dad is the coordinator. That shape fixed what markdown broke. It could not fix a different failure, and months of daily use made it visible. A worker brain would sometimes start assigned work without taking its coop record. More often it finished long work after losing the reminder to close it. Dad then repaired the ledger by hand, through Almanac or through another Pippa.

The tempting fix is one more line in a prompt: remember to take the row, remember to close it. The design doc for the new engine names why that fails: moving the reminder into another prompt leaves the same failure, because the thing that forgets is still a model. So the duty moved out of every prompt and into a process that does not forget.

Extract the domain, then move the writer

The move happened in two steps, and the order is the lesson.

• First the domain left the repo. The coop's rules (tables, transitions, what a done todo means) moved into cwkCoop, a family sibling of its own. cwkPippa's tools/coop stopped being the source and became a pinned compatibility bundle published from cwkCoop, with a manifest recording the exact commit and file hashes it came from. Nothing about how a brain calls it changed.
• Then the writer changed hands. On 2026-09-27 cwkCoop became the single office writer of the same database file. The path and the CLI stayed where they were; a small owner file routes every write to a private loopback service instead. Connection fences reject raw writes from the old path, including writers that were already open before the transfer. If the service is down, writes fail closed: they never fall back to writing the SQLite file directly. The eight fleet copies are read replicas carrying the same fences.

Doing it in that order let every caller keep its command: the domain moved first while the old writer still ran, and the writer moved last, when there was nothing left to move but the pen.

Two facts the engine keeps

The engine exists to keep two facts that must not depend on any model's memory: which actual session accepted which exact work items, and which accepted items still owe an outcome. A model still judges whether the work meets its acceptance criteria. The engine only makes sure that judgment stays owed until someone records it.

• It is honest about what it can prove. A harness that can establish ownership before the work starts is managed; one that cannot is only observed. Hooks turned out to be observations, not barriers: a command hook was measured letting execution continue after its timeout. So enrollment is explicit, never global. A session becomes managed when the workspace's assignment flow enrolls it for a piece of work; Claude's new-session path passed that end to end on 2026-09-28, while Codex's was still waiting on its own receipt. Every session nobody enrolled keeps the old workflow.
• The chief of staff is not a new brain. It is an ordinary Pippa conversation under the coop binder, shown in the same Sidekick as every other. When obligations come due, the engine wakes that conversation. It sends at most fifty obligations per wake and starts no more than twelve new reviews an hour, and Dad keeps his usual Stop and steer.
• An answer is not a disposition. The chief's reply counts only as an explicit, structured decision the engine validates against the chief's current authority. A failed or interrupted turn never closes work; a missing result stays visible for Dad instead of being silently retried.

Failing honestly at the seam

The compatibility bundle is where old habits meet the new owner, so it learned to say exactly what happened. A refused call is never recorded as committed. An authentication or validation refusal leaves a rejected receipt and names the status. A server error without a verdict leaves the receipt uncertain, to be reconciled later. An answer the client cannot read is never a commit.