Loopback Is the Product API

A Family Terminal That Cannot Be Opened Is Just Another iTerm

Waygate wants a folder in a new split. Watchfire wants a seat on a host. Anvil wants four panes that already know they are seats. If those apps have to pretend they are a human typing, you have rebuilt the seam: a byte stream with no objects on the caller side. The product API is a door, not a prompt. Siblings knock with a typed request. They do not send keystrokes.

The door is the loopback sibling door. Loopback means it is for apps on the same Mac, not for a browser on the LAN, not for a phone, not for a model on the other side of the network. The phone gets a different door later, on purpose — the tailnet mobile gateway. Publishing the sibling door would turn every local caller contract into a network contract, and a network contract that can type is a remote-control surface. This lesson names the local door and forbids that growth.

Typed Launches, Receipts, Stable Target IDs

What the door accepts: authenticated, typed launches. Open this folder on this host in a new leaf. Put this seat in that tab. The request names a target with a stable ID so the caller can talk about the same pane twice without scraping a title. What the door returns: a receipt. Accepted, bound to this session, this pane, this identity. A receipt is not a screenshot of success. It is a record the caller can hold, and the daemon can show later, without anyone pretending the bytes were a conversation.

Authentication is local and boring on purpose. The callers are family apps on this Mac, not a stranger with a URL. The door still authenticates, because "family" is not a firewall. A typed request from an unsigned process is how a helpful script becomes a keyboard. Receipts make that visible. A launch that produced no receipt is a launch you cannot audit, which is a launch you should not have allowed.

Never a Generic Input Verb

The door must never grow a generic "type this into a pane" method. That method is a model-callable keyboard. The day a brain can call it, the door is no longer a product API. It is a remote-control surface with extra steps, and every later rule about Pippa proposing while you type becomes theater. Launches and receipts. Folder, host, seat. No raw input. If a sibling's need cannot be expressed as a launch, the need is not a door need — it is a human at the glass, or it is a draft that stays outside the PTY, which is two lessons from now.

Loopback only. No published bind, no "just for debugging, open it to the LAN," no reuse of this door as the phone's door. Different audience, different credential, different lease. One daemon behind both, two mouths. This mouth is for the Mac's other apps.

The sibling door is loopback, typed, receipted. It launches. It does not type. A generic input verb is how a family API becomes a model-callable keyboard, and a published sibling door is how a local contract becomes a network weapon.

Code

What the loopback door will and will not say·text

SIBLING DOOR (loopback, same Mac, authenticated)
  accept:
    open folder F on host H as a new leaf (stable target id)
    place seat S in tab T
    return receipt { request, session, pane, identity }
  refuse:
    type(bytes) into pane P
    send(Enter)
    publish this door past loopback
    reuse this door as the phone's gateway

# Receipt is the audit object
  no receipt => the launch is not part of the product
  screenshot of a window => not a receipt

# Two doors, one daemon
  loopback sibling door     -> family apps on this Mac
  tailnet mobile gateway    -> approved devices, later track
  mixing them is the defect

Exercise

Write three sibling needs: open a folder, place a seat, paste a command. For each, mark door-legal (typed launch + receipt) or door-forbidden (raw input). For the forbidden one, name where it belongs instead (human at the glass, or a draft outside the PTY). If you marked all three legal, the generic input verb has already crept in.

Hint

Folder and seat are launches. A command string is a draft or a pair of human hands. The door does not become a keyboard to make the third one convenient.

A Family Terminal That Cannot Be Opened Is Just Another iTerm

Typed Launches, Receipts, Stable Target IDs

Never a Generic Input Verb

Code

External links

Exercise

Progress

Comments 0