Tribu can run on a kitchen tablet, hallway screen, office display, or wall-mounted dashboard without signing in as a real family member.

This mode is built for shared household spaces where anyone nearby can see the screen. The display is treated as a device identity, not as a user account.

A shared tablet should not require a parent, admin, or child account to stay signed in all day.

Using a normal account for a public household display creates avoidable problems:

• the tablet may expose personal profile, settings, notifications, or admin flows
• the account appears to belong to a real person in membership-related features
• assignments, rewards, birthday logic, and audit trails can become confusing
• removing access means changing or invalidating a real user's credentials

Shared Home Display solves that by pairing the tablet as its own display device.

The display dashboard is meant for glanceable, household-safe information, for example:

• today's family overview
• upcoming calendar events
• open household tasks
• upcoming birthdays
• family member display names
• read-only household context that helps everyone know what is happening next
• display-safe layout presets for tablet or e-ink style screens

The exact layout can evolve, but the boundary is intentional: this is a calm public dashboard, not the full logged-in app.

The display runtime is designed to avoid sensitive personal and administrative data.

It does not expose:

• email addresses
• user IDs
• user roles or admin flags
• profile/settings flows
• notification center content
• calendar source URLs
• assignment internals and private metadata
• a normal authenticated app shell

The display route also avoids the normal /auth/me and /families/me bootstrap calls, so a browser that happens to have a user session cookie does not silently fall back to that account.

Admin creates display -> one-time pairing link -> display stores token locally
Display opens /display -> display token auth -> read-only household dashboard
Admin revokes display -> token rejected -> display stops authenticating

1. Sign in as a family admin.
2. Open Admin → Displays.
3. Create a new display device, for example Kitchen Tablet or Hallway Display.
4. Copy the one-time pairing link.
5. Open that link on the tablet or wall display.
6. The display stores the device token locally and removes the token from the visible URL.
7. The tablet can now open /display directly.

The token is only shown once when the display device is created. If it is lost, create a new display device and remove the old one.

Admins can tune each display device without creating a new token:

• Display mode: tablet-style or e-ink-oriented rendering.
• Refresh interval: how often the display should update its household snapshot.
• Layout preset: a safe preset such as the default hearth layout or compact e-ink agenda.
• Layout config: normalized widget slots for allowed display widgets only.

The backend normalizes layout configuration before it reaches the display runtime. Unknown widget types are dropped, out-of-bounds widgets are rejected, and legacy identity / clock widgets remain compatible. Newer layouts can use the combined home_header widget for family identity plus clock content in one slot.

To remove access:

1. Sign in as a family admin.
2. Open Admin → Displays.
3. Find the display device.
4. Click Remove.

Revocation takes effect immediately. The paired screen stops authenticating and shows a removed-device state instead of falling back to a user session.

Shared Home Display uses a dedicated display token with a tribu_display_ prefix.

Important properties:

• Not a user: the display has no email, password, membership, role, rewards, assignments, or profile.
• Family-scoped: the token is bound to one family at creation time.
• Read-only runtime: the display token is accepted only by display endpoints.
• Separate auth boundary: display tokens are rejected by normal user endpoints such as /auth/me and /families/me.
• No user-token fallback: normal JWTs and personal access tokens do not authenticate the display runtime.
• Revocable: admins can remove a display without touching any real user's account.
• Hashed at rest: display tokens are stored hashed in the database. The plaintext token is returned only once.

This keeps a wall tablet useful without making it a hidden admin session.

Good fits:

• kitchen tablet
• hallway wall screen
• family command center display
• office or mudroom dashboard
• repurposed tablet in kiosk mode

Placement tips:

• use a dedicated browser profile on the device
• enable the operating system's kiosk or guided-access mode if available
• keep the screen in a shared area where display-safe information makes sense
• avoid pairing on devices used for personal browsing
• revoke and re-pair when repurposing or selling the device

• The display page is served at /display.
• Pairing links include the display token as a token query parameter.
• After first load, the route removes the token from the URL and stores it locally in the browser.
• The backend tracks when a display token is used so admins can see stale or unused devices.
• Display mode, refresh interval, layout preset, and normalized layout config are stored with the display device and included in /display/me and /display/dashboard.
• Back up the database normally. Display devices are regular persisted records and are included with the rest of Tribu data.

If a display cannot load after a deployment, first check that the backend and frontend are on the same version and that migrations have run.

Use a normal family member account when someone needs to:

• create or edit events
• manage shopping lists
• complete tasks as themselves
• access personal notifications
• change family settings
• administer members or integrations

Use display mode when the device should only show a shared, read-only household overview.

• Create a fresh pairing link from Admin > Displays.
• Open it once on the display device.
• Confirm the URL no longer shows the token after first load.
• Use a dedicated browser profile if another user session is confusing the device.

That is expected. Revoked display devices must be paired again with a new token.

• Check the display device refresh interval.
• Confirm backend and frontend versions match after an update.
• Refresh the browser once.
• Check reverse proxy caching if a proxy sits in front of Tribu.

• Do not pair display mode on a personal browsing profile.
• Avoid placing the screen where visitors can read private household context.
• Revoke the device before selling or repurposing it.
• Use display mode for read-only visibility, not for normal editing flows.

• README
• Self-Hosting Guide
• Architecture
• Security Policy