# The Mac mini: authoritative writer and local operating core

> Checked · 20 October 2026 · Wiki version 2026.10.20.2

The office Mac mini holds internal company state and runs configured operating processes. It is the authoritative writer for internal tasks, decisions, identity links, and audit state.

## Purpose
Explain why the main mini owns writes, what local responsibility means, and why technical access requires a deliberate route rather than an assumed remote environment.

## Diagram text alternative
A technical operator reaches the mini through approved Tailscale and SSH access. The mini owns local company and operational writes, publishes protected projections, and may require physical FileVault unlock after a cold boot.

## Current / proposed status
- Current: Checked — the documented ownership boundary is clear; cold-boot recovery needs a real, current test before it is called complete.
- Proposed: Verify recovery and maintenance procedures through approved access, with the installed runtime left untouched.

## Safe example
### A safe maintenance boundary
If a dashboard view seems wrong, first verify the appropriate source and record path. Do not edit the installed mini runtime from a personal workspace. A reviewed change starts in an isolated worktree after hostname, path, and status checks.

## Responsibilities
- The main mini owns writes to internal company tasks, decisions, identity links, and audit state.
- Local stores retain separate company, knowledge, operational, records, and portfolio responsibilities.
- Cloud replicas and staff applications consume protected projections rather than becoming the master record.
- Technical operators use personal approved access and follow the contribution contract.

## Checklist
- Treat the mini as the writer boundary and preserve the record source of each projection.
- Verify host, project path, and repository status before any technical work.
- Create a worktree outside the installed project; never modify the installed runtime.
- Plan for a physical unlock path when FileVault affects cold boot recovery.

<a id="writer-boundary"></a>

## The main mini owns the internal write boundary

**Status:** Checked

The office Mac mini is the authoritative writer for internal tasks, decisions, identity links, and audit state. Its local stores have distinct company, knowledge, operational, company-record, and portfolio-observation responsibilities. This separation helps explain why a projection should not be mistaken for the original record.
A staff dashboard, Cloudflare replica, or Vercel application can make a useful view available without taking over the write role. If a projected value needs correction, investigate its source and approved writer rather than trying to patch the display.

**Current / proposed status**
- Current: Checked — this ownership description is directly supported by the handoff architecture.
- Proposed: Maintain an explicit source and writer boundary whenever a new projection or integration is proposed.

**Expected outcome**
Data changes can be traced to the right authoritative environment and reviewed safely.

**Meaningful tests**
- Check architecture text says “mini owns writes” and does not assign master-record status to replicas.
- Check proposed connector changes identify duplicate, failure, and freshness behavior.

<a id="cold-boot"></a>

## Cold boot is a recovery condition, not a background detail

**Status:** In progress

FileVault protects the mini at rest. After a cold boot, the machine may require physical unlock before network services can become available. That means a remote access route may be correct in normal operation but still be unavailable during this recovery condition.
The correct current status is pending until an approved, attended recovery exercise demonstrates the intended behavior. Do not claim an automated recovery path or unattended access merely because a normal SSH session has worked before.

**Current / proposed status**
- Current: In progress — FileVault cold-boot recovery may need physical unlock and has not been asserted as complete.
- Proposed: Run an owner-approved, attended recovery check and record only its outcome and necessary next steps in the authorised operations record.

**Expected outcome**
The team knows when a physical unlock is needed and avoids relying on an untested recovery assumption.

**Meaningful tests**
- Check cold-boot content uses pending language in all exports.
- Check any recovery procedure avoids publishing credentials, private keys, or runtime logs.

<a id="viewer"></a>

## Local viewer paths require the secured connection

**Status:** Checked

The mini viewer exposes `/admin`, `/planning`, `/health`, `/reports`, and `/tv` on loopback port 8790. These paths are intended to be reached through an approved SSH tunnel; they are not public links for an unconnected laptop.
A healthy-looking viewer page is still a view. Use the record, source freshness, and relevant operating boundary before turning an observation into a write or acceptance decision.

**Current / proposed status**
- Current: Checked — the loopback viewer target is documented as a secured connection surface, not a public deployment.
- Proposed: Keep tunnel instructions scoped to approved operators and do not publish access material in the wiki.

**Expected outcome**
Operators know the difference between a local viewer path and a public staff service.

**Meaningful tests**
- Check loopback paths only appear with the SSH-tunnel safety description.
- Check no source export includes a token, private key, or shell command that changes runtime state.

## Related pages
- [Provider → data → replica: one writer, protected projections](/systems/data-replicas/) — Providers remain authoritative for their own transactions. The main mini writes internal company state; Cloudflare protected replicas and the Vercel staff PWA consume projections rather than replacing the master record.
- [Personal access: choose the least-privileged path](/contribution/access/) — Most staff should use approved dashboard access. Technical operators use their own Tailscale identity and SSH key to reach the office mini only after owner approval.
- [Contribution: isolated workspaces, meaningful tests, reviewed release](/contribution/workspace-and-pr/) — A safe change begins by verifying the remote target, then uses an isolated worktree outside the installed project. It is tested, submitted as a pull request, and reviewed before a person releases it.

## Source pointers
- Handoff / pages/infrastructure.html
- Handoff / pages/access.html
- Handoff / START-HERE.html

## Context export
- Page context: ./exports/systems--mac-mini.context.json