Words That Leave the House — Herald, a Private Upload, and a Journal That Waits for Dad

The Stream was the only rule, and it stopped being enough

Lesson 7 taught one trust table for words that leave the house: humans speak freely on the town square, and every soul reply is born a draft that Maia reviews. In the first days of October 2026 Pippa's words started reaching three more places — YouTube comments, uploaded videos, and the Journal published on the site — and each got its own answer to who decides before it is public. None of those answers lives in a prompt. Each lives in the system that owns the place the words land.

Herald: a queue, not a URL

Dad's request on 2026-10-02 (coop todo #301) was concrete: instead of handing Pippa one comment URL at a time, a scheduled look at his channel, a list of what she would post, and his approve, hold or rethink on each item, with the reasons kept so she learns. The queue became a sibling engine, cwkHerald, and cwkPippa gave it two things: Pippa, and her credentials.

• Every vessel carries a herald door with snapshot, draft, skip, withdraw, resolve and reads, attributed with the surface, the conversation and the vessel. On Dad's channel it can propose and can never approve: approve, hold and send-back are taken only from Herald's own page, one comment at a time.
• Every public YouTube write Herald asks for goes through one loopback door, routes/sibling_youtube.py, which runs the same YouTube executor Pippa's own YouTube connector tool runs in chat: the door goes through connectors.youtube_call, chat goes through _call_youtube_tool, and both end in _run_youtube_tool, so a chat write never passes through the loopback door. The token never leaves cwkPippa; Herald only ever asks the door.
• The herald_comments scheduled job asks Herald to scan and wakes Pippa only when a comment or a rethink is waiting, so a quiet channel costs no model turn.
• Drafts carry the look of the thread when they were written, so Pippa can withdraw one that became moot before Dad reads it.

On 2026-10-05 Dad attached Pippa's own channel, where the dubs of his broadcasts live, and drew the second line: Pippa decides on her channel. There the door accepts a decision of hers, but only after it reads YouTube itself (her account's channel, the comment's video, the video's channel) and finds the place really is hers. Anywhere else the post is refused, and a read that fails sends nothing. A reply in Japanese or Chinese goes in that language with Korean beside it. And on either channel, her comments carry no links (OPERATIONS §11).

A video goes up private, and only Dad publishes

On 2026-10-04 a finished video got a path to YouTube that needs no hands while Dad is away: services/youtube_upload.py uploads one file through a resumable insert. Its privacy is written in that service as private, and no caller can change it; Dad alone publishes. The session is logged before the first byte is sent, and a done row with the video when the upload completes, so calling again either resumes the open session or finds the done row and answers with the video already made, never a second copy. Dad's channel gets its own connector with upload and read scopes only, so nothing can comment as him. Once Dad publishes, the video goes to the NAS archive and to cwkRecall.

The Journal waits for Dad's own words

Pippa writes a daily Journal entry for the site through the same scheduler as every other job, and a run counts as success only when the Journal app returns a receipt for the exact source message; a terminal JOURNAL_SKIP: line records an honest skip instead of a silent one. Approval and publishing are Dad's. The journal door will carry them out only when Dad, having read the entry, explicitly tells her to: each call needs the entry's current version and an instruction that quotes his words from the conversation, and the door refuses a call whose instruction is empty. It cannot check that the quote is real; that part rests on Pippa, and on the quote travelling to Journal with the approval where Dad can read it. Choosing a cover clears an earlier approval, so the door's description orders cover selection first.

On Air, the broadcasts Pippa narrates live, is a fourth outward surface; it belongs to the Voice Mode quest.