The Offline Exception

"One scoped exception to 'no own brain' — a degraded local fallback that steps aside when you switch the real brain back on."

The One Deliberate Exception

'No own brain' has exactly one approved exception: the offline tier. When no cwkPippa is reachable at all — no localhost, no Tailscale — Rekindle can fall back to a local Ollama model (default gemma4:31b) running a persona-only Pippa. It's there so a plane, a dead network, or a hotel with no VPN doesn't leave the margin completely silent. But it is a fallback, defined by what it deliberately is not.

What Makes It a Fallback, Not a Fork

The offline Pippa is bounded on every side. Its persona is a baked copy of cwkPippa's own — not a new personality, a snapshot of the real one. It has no vault and no memory beyond a local transcript. It gets one scoped tool (Bash, through a guarded bridge — a Rust command in the 2026-07 build, native Swift since v4, where OfflineBash spawns the shell with posix_spawn), not the full tool suite. And it is temporary by construction: while it's on it never pretends to be the brain, and it steps aside when you flip the connection mode back. It never invents a second memory system, a second protocol, or a second identity.

Offline Pippa — bounded on every axis
  persona   a BAKED copy of cwkPippa's own (a snapshot, not a new self)
  memory    none beyond a local transcript (no vault)
  tools     one scoped tool (Bash via a guarded bridge)
  lifetime  degraded fallback; steps aside when you switch the mode back

Scoped on Purpose

The discipline here is what keeps the exception from eating the rule. An unbounded "just run a local model when offline" would quietly become a second Pippa — its own memory, its own drift, its own identity — and 'no own brain' would be dead. Bounding it (baked persona, no memory, one tool, a manual switch back) makes it a genuine fallback: it covers the gap without becoming a rival. That's the general shape of a safe exception — narrow, explicitly degraded, and reversible the moment you switch the mode back.

Code

The offline tier, bounded so it stays a fallback·text

Offline Pippa is defined by its LIMITS, not its features:
  persona    a BAKED copy of cwkPippa's own (snapshot, not a new self)
  memory     none beyond a local transcript (no vault)
  tools      exactly one, scoped: Bash through a guarded bridge
             (Rust in 2026-07; native Swift OfflineBash since v4)
  lifetime   degraded fallback; steps aside when you switch back to the full brain

# Bounded on every axis -> a fallback.
# Unbounded -> it silently becomes a second Pippa, and 'no own brain' is dead.

Exercise

Design an offline fallback for a cloud-dependent feature you use, and bound it deliberately. Answer four questions: what persona/behavior does it get, what memory (ideally none), what tools (as few as possible), and how do you switch back when the real service returns? Then explain how an unbounded version of the same fallback would quietly become a permanent second system.

Hint

The four bounds are persona (a snapshot, not a new one), memory (none/local-only), tools (minimal-scoped), and lifetime (you switch back manually). The unbounded failure mode is always the same: it starts remembering, starts being tuned, and stops being a fallback — becoming the parallel system you were trying not to build.