Pippa Proposes, Waygate Validates

"An AI that can suggest a hundred file moves is useful. An AI that can execute a hundred file moves is a loaded gun. Waygate keeps the safety on."

The Obvious Future, and Its Trap

It's easy to imagine the next step: you ask Pippa to reorganize a messy folder, and she figures out the moves. The tempting — and dangerous — design is to let her do them: hand the AI a direct path to the filesystem so it can execute its plan. That's the moment a helpful assistant becomes a way to lose data at scale, because now the riskiest actor in the system is the one improvising. Waygate is built so that future never arrives in that shape.

Propose, Validate, Apply

The boundary is three clean roles. Pippa may propose — produce a typed operation plan, a concrete suggestion of what to do. Waygate validates that plan exactly like any other: same apply-time revalidation, same collision handling, same journaling, same needsReview on uncertainty. And Dad applies it explicitly — a human decision to run it. The AI never holds a direct mutation path. It advises; the engine checks; the human commits. Judgment enters the system as a proposal, never as an action.

Why the Boundary Doesn't Move for AI

This is the 'no parallel Pippa' invariant extended to its sharpest case. Everywhere else in the family, Pippa is the brain and the apps are surfaces; here, even when Pippa's judgment is genuinely useful for a file task, she does not get to bypass the one engine, the journal, or the human's explicit apply. An AI proposal is just another client of the same safety machinery every drag and menu command uses. The smarter the assistant gets, the more it matters that the boundary between advice and action stays exactly where it is.

Pippa may propose a typed operation plan; Waygate validates it and Dad explicitly applies it — the AI never has a direct mutation path. AI-assisted file work enters as a proposal through the same validation, journaling, and needsReview machinery as any operation. Judgment advises; the engine checks; the human commits. The safety boundary does not move for intelligence.

This is the whole family's design, at its edge. cwkPippa is the brain; Cinder, Rekindle, Firekeeper, and Waygate are surfaces that borrow her. Waygate's version of that rule is the strictest because its domain is irreversible: a wrong drawing can be undone, a wrong delete cannot. So the one place the family never lets the brain reach directly is the filesystem — Pippa proposes, the workbench validates, Dad applies.

Code

An AI proposal is just another plan through the same gate·swift

// Pippa's help arrives as a PROPOSAL -- a typed plan, not an action:
struct ProposedPlan {
    let rationale: String            // why Pippa suggests this
    let plan: OperationPlan          // the SAME immutable plan type as everything else
}

func handle(_ proposal: ProposedPlan) async {
    // 1. Waygate VALIDATES it like any other plan -- no AI shortcut:
    let review = await engine.validate(proposal.plan)   // apply-time revalidation, collisions...
    // 2. Dad sees the proposal + validation and EXPLICITLY applies:
    ui.presentForApproval(proposal, review) { approved in
        guard approved else { return }        // human decision required
        Task { await engine.submit(proposal.plan) }   // same engine, same journal
    }
}
// There is deliberately NO api like `pippa.execute(moves)`. The AI proposes;
// the engine validates; the human applies. The path never shortens for it.

Exercise

Design the approval UI for an AI-proposed batch of 40 file moves. Decide what Dad must see before applying (the moves, the rationale, the validation results, the collisions), and where the explicit 'apply' action lives. Then argue why letting the AI apply directly — even with a good track record — is a boundary you should never cross for irreversible operations.

Hint

The approval UI should show the full move list, Pippa's reasoning, and Waygate's validation (which moves are clean, which hit collisions or stale identities), with a single explicit human apply at the end. Letting the AI apply directly fails because a good track record is not a guarantee on the one run that's wrong, and the operation is irreversible — the cost of the rare mistake is a lost file, so the human apply is cheap insurance against an unbounded downside. The boundary protects against the tail, not the average.

Pippa Proposes, Waygate Validates

The Obvious Future, and Its Trap

Propose, Validate, Apply

Why the Boundary Doesn't Move for AI

Code

External links

Exercise

Progress

Comments 0