A direction paper, 2026-07-11, written against Anton’s handwritten focus-area sheet. Proposal only: nothing here is built, scheduled, or promised. Directions, not maps — compass headings you can argue with. No code was touched for this.

The headline

Bureau stops being a demo of an OS and becomes the OS of one person’s day — by opening seven drawers, one life-area at a time, each drawer a new projection of the same event log.

A bureau is a writing desk with drawers. The focus-area buckets are the drawers: work, self, friends, the wire, play, study, and the satchel you carry out the door. You don’t build seven products; you point the same four proven mechanisms at seven parts of a life. The desk stays one desk.

Why this can work: four inventions, seven pointings

Everything proposed below reduces to a mechanism that already runs live:

1. The log. Every surface is a projection of one append-only event stream. So “mobile” is a phone-shaped projection, “multiplayer” is two projections of one log, and “memory” is a fold over it. New drawers rarely need new truth — they need new reductions.
2. The ratify card. Human consent as a first-class desk object, proven on self-extension (worktree → QA → ratify → merge). It generalizes to every act that leaves the house: sending a message, spending money, admitting a guest.
3. The press. A model writes small validated JSON; a deterministic engine renders a calm 1981 page. Proven on news, X, and Gmail. It generalizes to work dockets, study sheets, retrospectives — the house style for anything arriving from outside or from overnight.
4. The skin. Generated warmth on every primitive, three full kits live. It generalizes to moods, seasons, and gifts.

Rule of thumb: if a proposed feature doesn’t reduce to one of these four, it probably belongs to a different product.

Drawer 1The Workshop

Knowledge · Work · Software development · Agentic harness

Work you can watch; a harness you can live in.

This is Bureau’s proven core, promoted from “feature” to “place”: Claude workers with real ground, cards that render for zero tokens, apps that morph into existence, a grammar that extends itself behind a ratify card, and (since 782fd15) workers you can seize from your phone.

What goes in the drawer:

• The Docket. Each morning the paper grows a work page: what ran overnight, what changed (the git diff digests already on every card), and — as the lead story — what’s blocked on you (needs_input items). Pressed once, not streamed. Your standup, delivered as newsprint.
• Standing orders. Scheduled workers (“every morning, triage the repos”; “Fridays, sweep my downloads”) whose runs are visible as ordinary cards and whose output lands in the Docket, never in a pile of notifications.
• Dossiers. A research worker that doesn’t end — it accretes a document in the log that the shell can recall and the paper can excerpt. Knowledge as sediment, not as chat scrollback you’ll never reread.
• Enter anywhere. Entering a card is already a subthread; with remote control, the harness follows you — start a refactor at the desk, redirect it from the bus.

MVP: the Morning Docket. A deterministic projection of agent events into a pressed page — the engine renders anything that validates, and agent digests already exist. One editor pass of spend, batched into the daily edition.

Drawer 2The Mirror

Personal HI

The system’s working model of you, kept where you can see it — and correct it.

Reading “HI” as human intelligence: the counterpart to the AI. Bureau’s founding ethic is showing the model’s literal context (the context drawer, token bar included). The Mirror is that same ethic turned toward the person. The parts already exist: profile facts, the five-section memory document folded by the compactor, remember/recall, the taste vector, The Inbox.

What goes in the drawer:

• The Memory window. The actual memory document as a first-class surface. Read it. Correct it (“that’s stale — I moved”) and the correction is a remember event, visible in the log like everything else. Watch compaction fold your day into it. No hidden dossier — the dossier, on the desk.
• “What do you know about me?” answered verbatim with provenance — which turn taught it, which onboarding tap implied it. Honesty as a feature.
• Open threads, gently. The memory doc already keeps an Open Threads section; surfacing it each morning is the kindest todo list Bureau could ship — remembered, not nagged.
• The year in the log. The event log is an accidental autobiography. Once in a while, press a retrospective edition from it — the only newspaper in the world with a circulation of one.

MVP: the Memory window + correction flow. Pure presentation over events that already exist. Near-zero cost, immediately demo-able, and it makes every other drawer smarter — profile facts already condition composition and the shell’s instructions.

Drawer 3The Parlor

Connection · Friends

Hosting, not messaging. Few people, high warmth.

The Parlor is deliberately not a chat app. It’s the room where you receive people: they step into your place, it’s wearing your skin, and there’s something on the desk worth showing.

What goes in the drawer:

• The guest pass. A one-time link that admits a friend to a scoped view — the app you built, the paper, the trip board — read-only, expiring, with presence shown honestly (“Sam is looking”). Multi-tenant accounts already exist; what’s new is inviting someone across the threshold.
• Postcards. A small skinned card sent desk-to-desk. It doesn’t buzz; it arrives — a thing on the desk in the morning, not a notification.
• Gift skins. Bake a skin for someone (sanctioned spend, like all bakes). The most Bureau-native gift possible: here is a whole mood, made for you.
• Editions for two. Press a paper from shared material — the trip you’re both planning, the project you both watch — and both desks get the same morning read.

MVP: the guest pass, read-only and window-scoped. It’s also the honest first test of the hard problem here (see risks): today an account’s log is all-or-nothing; guests need a visibility scope that doesn’t exist yet.

Drawer 4The Switchboard

Communication · Social · Multi-player

Lines out, lines in, party lines — with a signature required at the door.

Where the Parlor is intimate, the Switchboard is plumbing and play: many people, shared control, words leaving the house. The 1981 name is earned — an operator sits between you and the wire.

What goes in the drawer:

• Two cursors, one desk. The desk is a projection, so multiplayer starts almost free: a second browser on the same account already watches the same live log. Add presence (named cursors, who’s-here) and then attribution (whose turn was that) and the desk is genuinely multi-player.
• Shared workers. A worker two people can message; the card is the shared object, and its ask_user pause can address the room. Pair-working an agent is a genuinely new kind of multiplayer.
• Outbound with a ratify card. The shell drafts the reply, the post, the RSVP — and a ratify card asks for your signature before anything leaves. The self-extension consent pattern, generalized from code to speech acts. Nothing outbound without ratification should be a house non-negotiable from day one.
• The party-line shell. The open design question: one brain, two humans. The working set needs author-tagged turns, and “the user” becomes “the room.” Worth designing slowly; it touches identity everywhere.

MVP: the presence layer + author-tagged turns — one additive shared/events.ts change, frozen before any fan-out (skill 23), never rewriting history (rule 5). Then one demo: two browsers steering one worker.

House rule proposal: the Switchboard obeys the Salon. Inbound arrives pressed or as cards — never as a live stream onto the desk. Bureau exiled the feed once; comms features don’t get to smuggle it back.

Drawer 5The Salon

Fun · Attention management · Skinning · Dispatch · Picturing

Attention is the product; spend it beautifully.

The soul-drawer, and the most-built already: three full kits, skin inference from taste, the fidget slot (nine tiny games, one at a time — 2b6945c learned that lesson), the Dispatch reader with THE FEED and THE INBOX, real vision via view_image, and gpt-image-2 chrome generation.

What goes in the drawer:

• Desk hours. The desk re-dresses by time and ritual: the work skin at nine, the evening skin at six with the paper folded onto the dock, a “reading hour” that dims everything but the broadsheet. Skins as circadian rhythm rather than preference.
• Picturing, both directions. The shell can already look (view_image); let it also keep — a corkboard window where pictures worth keeping get pinned, and occasional sanctioned generation for masthead art or a skin’s seasonal variant. In before out; looking is free, making costs.
• The fidget economy. Fidgets stay tiny and single-serving; new ones arrive via build_app like toys from a vending machine. A gentle place for restless hands that never becomes a casino.
• The paper stays the feed-killer. The detox thesis, held: X and Gmail arrive once a day, pressed, typographically calm. The Salon’s whole job is to make the calm thing the desirable thing.

MVP: desk hours — scheduled set_skin plus a reading-hour arrangement. No new spend, no new truth in the log beyond events that already exist; mostly choreography.

Drawer 6The Study

Learning · Organization · Student’s work

The desk as a carrel; the harness as a patient tutor.

Bureau pointed at a learner — possibly Anton learning, possibly an actual student with their own account and PIN (both readings work; see open questions).

What goes in the drawer:

• The Study Press. Point a worker at a folder of notes; it presses a revision broadsheet through the existing engine. Study sheets in 1981 typography, with a masthead and column rules, are the most desirable revision material ever printed — you’d want to read them, which is the entire battle.
• The tutor worker. A conversational worker whose ask_user pauses are Socratic: it genuinely stops mid-turn and waits for your answer (the blocking-tool pattern, skill 9), rather than lecturing past you.
• The cards app. Spaced repetition as a native app, fed by Study Press leftovers. Streaks live quietly on the card — encouragement, not a guilt graph.
• Course desks. An account per course: a clean desk whose log is the learning record. End of term, press the retrospective — everything you asked, built, and finally understood.

MVP: the Study Press. One worker, one folder, one editor spend, zero new rendering machinery. Likely the highest charm-per-line-of-code in this whole paper, and a natural second tenant for the accounts system.

Drawer 7The Satchel

Mobile · Portable

Not the desk shrunk — the desk distilled.

The tunnel already reaches any device, the reader already has a phone fit, PWA meta tags just landed in index.html, and worker remote-control from the phone is pending one gateway restart. The satchel already has one strap.

What goes in the drawer:

• The pocket projection. A phone-shaped route over the same log: transcript, agent cards, the paper. No canvas, no window management — a different reduction of the same truth, which is the architecture’s whole thesis paying rent.
• The nudge. needs_input reaches the pocket as a push; one tap opens the card; your answer resumes the paused tool. The single highest-value mobile moment Bureau can own — your agents can wait for you politely.
• Voice out of the house. Hold-to-talk to the same one brain (voice already mirrors into the text memory); the desk shows the conversation when you get home.
• The commute paper. The edition, offline-cached and phone-fit. The detox app Dispatch always wanted to be, riding an OS.

MVP: the pocket projection + the needs_input nudge. Honest caveats up front: mobile voice quality is a human checkpoint by constitution (never self-certified), and iOS Safari has already shown its personality (the autofill scar in the README).

How the drawers connect

Not a dependency graph — a small set of named flows:

• The Docket (Workshop) is pressed by the Salon’s engine and read from the Satchel on the train.
• The Mirror conditions everything — profile facts already steer composition and instructions; a correction in the Mirror changes how every other drawer behaves toward you.
• The Parlor borrows the Salon’s gifts (skins, postcards) and the Switchboard’s plumbing (presence, accounts), governed by the Mirror’s sense of what’s private.
• Everything is the log; everything outbound signs a ratify card; everything inbound arrives pressed; everything wears the skin.

The pull order (a suggestion, not a schedule)

Inward before outward, cheap before spendy, presentation before contracts:

1. Mirror — projection over existing events; makes everything else smarter.
2. Workshop Docket — deterministic + one batched press.
3. Study Press — one worker, one press, maximum charm; second tenant.
4. Salon desk hours — free choreography.
5. Satchel pocket projection — a new reduction, no new backend truth.
6. Parlor guest pass — design the visibility scope first.
7. Switchboard multiplayer — freeze the authorship contract first; savor it.

Risks and open questions

• “Personal HI” is read here as human intelligence — the system’s model of you. If the sheet meant human interface, the Mirror mostly survives the reinterpretation, but say so and it can be reframed.
• “Student’s work” is read as Bureau-serving-a-learner. If it names an actual student, the Study becomes a second-tenant story — which the accounts system was quietly built for.
• The outward turn changes the threat model. Today’s privacy story is one lock screen and per-account PINs; guest passes need window-scoped visibility, a concept the reducers don’t have. It must be designed, not bolted on — the og:image caution in the journal shows the right instinct.
• Multiplayer touches the sacred contract. Author identity on turns is an additive shared/events.ts change — frozen before any parallel work, and never a rewrite of history.
• The attention paradox. Comms features can smuggle back the noise the paper exiled. The proposed house rule — nothing streams onto the desk from outside; everything arrives pressed or as a card — should be treated as seriously as “nothing faked.”
• Spend discipline. Every press is a paid editor pass; drawers that want daily output (Docket) should batch into the existing daily edition rather than multiply presses. Image and bake spend stay explicitly sanctioned, as ever.
• One brain, many rooms. As drawers multiply, the working set must stay sparse. The scaling law is already in the house: everything gets a one-line digest, full forms page in on focus. A drawer that wants standing context earns a memory-doc section, not a resident window.
• Mobile voice is human-checkpoint territory. Machine-green is not done; the constitution says a human ear decides.

Three days, walked through

Directions are easier to judge as mornings than as diagrams. Three narratives, each naming the mechanisms as they fire.

A Tuesday (one person, five drawers)

07:40, the Satchel. The phone shows one nudge: the repo-triage worker paused overnight on a real question — “two lockfiles disagree; which package manager is canonical?” One tap opens the card, one line answers it, the paused tool resumes (ask_user, exactly as it works today). On the train, the paper: front page, THE FEED, THE INBOX — and the back page is THE DOCKET. Three runs finished overnight; one diff digest worth reading; nothing else blocked.

09:00, the desk. Work hours land (Salon): the focus skin, the paper folded to the dock. The Mirror’s open-threads line remembers the deploy postponed on Friday — remembered, not nagged. You enter the triage worker’s card (Workshop), redirect it in three sentences, exit; a single digest line follows you back to the main thread.

18:00. The evening skin arrives mid-sentence, the way the bake did in the first demo. Reading hour dims the canvas around the broadsheet. One fidget while the kettle boils. Overnight the compactor folds the day into the memory document — tomorrow’s Mirror already knows the deploy shipped.

Mechanisms fired: the log (everything above is events), the press (the Docket), the skin (hours). The ratify card never appeared — nothing left the house today, so nothing needed a signature.

A visit (the outward drawers)

Saturday. You built a little tide-clock app and want to show Ola. The shell mints a guest pass scoped to two windows — the app and the paper — expiring tonight. Ola opens the link: your desk, wearing your skin, exactly two windows, a quiet presence line saying “Ola is looking.” No typing; this year the Parlor is a viewing room, and that’s the point.

Later, the party line. Both of you on one desk (Switchboard), steering one worker to plan the June trip. Two named cursors; the transcript attributes each voice. When the worker drafts the booking email, a ratify card waits for the owner’s signature — the draft is readable in full, the send is one press, and nothing outbound moves unsigned. Monday a postcard lands on Ola’s desk: the itinerary pressed small, in your skin. It doesn’t buzz. It’s just there.

A study week (the second tenant)

Monday. A student gets an account: clean desk, own PIN, own log. The tutor worker reads the course folder and starts asking — and its questions genuinely pause, mid-turn, until answered (the blocking-tool pattern). Shaky answers become remember events; by Wednesday the Mirror carries an honest “wobbly: glycolysis, week 3” line without anyone writing it down.

Thursday night. “Press me a revision sheet.” The Study Press sets the week in five columns of 1981 type, wobbly topics above the fold. Friday, the Satchel: the sheet on the phone on the bus; ten minutes of the cards app outside the exam hall. End of term, the retrospective edition presses itself from the log — which was the learning record all along.

The MVP slices, scoped

Each slice says what’s in, what’s deliberately out, and what “done” means — in the house style, done means verified on the live path, with human checkpoints where the constitution demands them. No dates; these are shapes.

1. The Morning Docket (Workshop)

• In: a new module page in the daily press (the same additive mechanism THE FEED and THE INBOX used); deterministic collection of agent activity since the last press — runs, diff digests, and needs_input items as the lead.
• Out: worker scheduling (“standing orders” are a later pull); any extra press beyond the existing daily one; new verbs.
• Done when: a real morning edition for the primary account carries a work page built from real agent history in the log, at zero additional presses.

2. The Memory window (Mirror)

• In: the literal five-section memory document plus profile facts rendered as a desk surface; corrections flow through the existing remember verb; each fact shows provenance (which event taught it).
• Out: direct editing of the document (corrections are events; the compactor folds them in — the log stays the only pen); new memory sections.
• Done when: “what do you know about me?” is answerable by pointing at the window; a correction lands as an event and survives a full replay.

3. The guest pass (Parlor)

• In: an expiring, read-only token scoped to a named set of windows; presence shown to the owner; the guest sees the owner’s skin.
• Out: guest input of any kind; general per-window ACLs (the pass’s allowlist is the only scope); anything cross-machine between Bureaus.
• Done when: a second browser holding the pass sees only the chosen windows, live; expiry verified; nothing else in that account’s log is reachable. Gated on a short visibility-scoping design note first — this is the drawer where a bolt-on would haunt us.

4. Presence + attribution (Switchboard)

• In: author identity on user turns (one additive contract change, frozen before any fan-out); named cursors / who’s-here; one demo of two browsers steering a single shared worker.
• Out: outbound sending (ratified outbound is its own later slice); a second brain; cross-account desks (this slice is same-account, two browsers).
• Done when: both browsers type, the transcript attributes correctly, the worker addresses the room — and a replay rebuilds the same desk.

5. Desk hours (Salon)

• In: a per-browser schedule (the existing desk-settings pattern) driving the existing skin-change path, plus a reading-hour arrangement that foregrounds the paper; a manual toggle for the same moods.
• Out: generated seasonal assets (spend); server-side cron; any new event kinds — the desk re-dresses through the same door it always has.
• Done when: the hour turns, the desk re-dresses, the paper folds forward, and the log tells the story the same way on replay.

6. The Study Press (Study)

• In: a worker briefed to read one folder of notes and emit a study sheet that validates against the existing Issue schema; pressed by the existing engine; read in the existing reader.
• Out: schema changes (if the schema can’t express a study sheet, that’s a finding to bring back, not a license to fork it); the cards app; the tutor persona.
• Done when: a real notes folder becomes a real pressed sheet on the desk, one sanctioned editor spend, logged.

7. The pocket projection (Satchel)

• In: a phone-shaped route over the same socket and log — transcript, agent cards, the paper dock; a visible nudge when needs_input fires.
• Out: the window canvas; mobile voice (human-checkpoint territory, later slice); offline caching. Honest note: true push (rather than an in-page nudge) brings service-worker plumbing with it — the slice can land with the in-page nudge first and stay honest.
• Done when: a phone on the tunnel sees the live desk-distillate, and a paused worker visibly reaches the pocket.

The assumptions register

Made rather than asked, per the working mode; each is cheap to reverse.

1. “Personal HI” = personal human intelligence — the system’s model of its person. If it meant human interface, the Mirror survives mostly intact but the drawer should be renamed and re-scoped.
2. “Student’s work” = Bureau serving a learner. If it names an actual student in Anton’s life, the Study is a second-tenant story and the accounts system is already dressed for it.
3. “Picturing” = vision in + images out (view_image already live; generation stays sanctioned) — not picture-in-picture, not photography management.
4. “Multi-player” begins same-account (two browsers, one log) before any cross-account desk; cross-account starts at the Parlor’s guest pass.
5. Mobile = the browser over the existing tunnel (PWA at most), not a native app.
6. The paper remains the only inbound channel for external content — the proposed “nothing streams onto the desk” rule is assumed adopted.
7. All new spend stays sanction-gated; no drawer introduces an autonomous spend path. Daily surfaces batch into the existing daily press.
8. Drawer names are proposals — the frame survives renaming.

Recommendations

1. Ratify the frame before any drawer. Adopt the four-mechanisms litmus test and the “nothing streams onto the desk” rule as BRIEF-level non-negotiables. They’re the cheapest decisions in this paper and they prevent the expensive ones from going wrong.
2. First pull: Mirror + Docket together. One inward stretch of presentation-only work — no contract changes, near-zero spend — that compounds: the Mirror makes every drawer smarter about its person; the Docket makes the Workshop legible enough to trust with more.
3. Design gates on the outward drawers. A visibility-scoping note before the guest pass; a frozen authorship contract before multiplayer. Both are one-page documents that save a rewrite each.
4. Keep the Study Press as the show-piece. When Bureau needs to explain itself to a stranger, a worker turning their own notes into a 1981 broadsheet is the whole thesis in ninety seconds.

A bureau with seven drawers is still one desk. Open them one at a time, keep the key in the ratify card, and let the paper report on all of it.