0032. The hub is home's installable front door for phones, and home is its backend
Status: accepted, 2026-10-21
Context
The owner decided that phones get an installable web app with push, a hub at <d>/app, and not one console
that loads every panel. The nineteen panels stay on their own hosts with their own sessions (ADR 0006), and
ADR 0030 keeps them from being installed one by one, so the hub is the only place an iPhone gets Web Push
without APNs: Safari delivers push only to a web app on the Home Screen. A phone needs a little from many
services at once: what needs me now, my notifications, approvals, search, and a handful of actions
(acknowledge, roll back, restart, read logs, turn a flag off). The rejected console carried an access token in
JavaScript that reached every service, so one injected script reached everything; installable panels would
mean nineteen icons, nineteen push subscriptions and the same notification several times.
Decision
- The hub is a second front end of home at
<d>/app: Today, the inbox, search, approvals, services and
the person's settings. It is installable (a manifest and a service worker), the only web app that subscribes
to Web Push, and inside Telegram it is the Mini App (ADR 0033). It draws a few kinds of objects itself and
opens the owning panel for everything else; it renders no server-described screens.
- home is its backend-for-frontend. The hub's JavaScript holds no token that works beyond home: it talks
only to
<d>, and home calls services with the person's own token. The hub reaches services only through
home's operations (Today, the glance, search, the project canvas, running listed actions), proxies (the
inbox, the live stream, approvals, push devices) and a reviewed allow-list of named operations, never
sensitive, critical, upload or download ones. The allow-list is code in home, not a setting.
- Today is current state, not a feed: approvals waiting for the person, notify's open alerts, and items
that services serve through a standard attention operation. A problem with an alert key is an alert
(ADR 0023) and never an attention item.
- Web Push from the hub only, one subscription per device, at
<d>, in the declarative format that
Safari shows without running the worker. notify's own panel push becomes a legacy path and ends.
- The same operations serve every client. Today, the glance, search and the canvas are public operations
of home that the native apps, the CLI and MCP call with their own tokens (ADR 0018); only the allow-list
gateway is limited to the hub's sessions.
Consequences
- If home is down, the hub is down and shows its last answers with their age; panels and Telegram
notifications keep working. home answers partially when a service is slow and never fails because of one.
- Services implement attention, resources and search operations where they have something to show; home fans
out to them with deadlines and caches.
- notify keeps a per-person inbox with read state and a live stream; a push device is one channel per
installation of the hub.
- Signing in from the installed app is the ordinary redirect through id, with sign-in by code (id's device
grant used by home) as the fallback; passkeys stay at id (ADR 0006).
- Design:
superpowers/specs/2026-10-21-phone-hub-design.md in this repository.