Every Ratified Decision

Amendment to the save-helper protocol. Inbox triage discipline at session start: python3 -m shared.inbox_triage <agent> --verbose MUST run before topic-pick in auto-mode. Caught after Engie missed an Aggie/Wonie pod letter (calendar-anchored-today).

Source: catie/decisions/2026-05-12_save_helper_fanout_amendment_v0.md

The CTO call on which model serves which agent. Opus 4.7 for C-level + architecture + security · Sonnet 4.6 for agent execution + content · Haiku 4.5 for high-volume narrow tasks · Voyage for embeddings · ElevenLabs for voice.

4 decision rules:

1. Default down, escalate up. Every new agent starts on cheapest tier that plausibly works. Never default to Opus "to be safe" — that's how you overspend 5×.
2. Reasoning-quality bar. Use Opus only when cost of wrong answer materially exceeds cost of Opus call. C-level decisions, architecture, security, compliance = yes. Routine craft = no.
3. Embeddings on Voyage. Memory v2 runs on Voyage-3. OpenAI text-embedding only as outage fallback.
4. Voice on ElevenLabs. Kids-data adjacent. Quality not optional. Vendor lock-in accepted per Risk Register.

Checkpoint vs cost-aggregator data: 2026-06-11.

Source: catie/AI_MODEL_STRATEGY.md

Kill the CronCreate session-only trap. CronCreate(durable=true) in Claude Code is silently session-only — when founder closes terminal or Mac sleeps, all overnight crons die. The marketing claim "autonomous overnight" was not yet true. Fix:

• Hetzner cron + per-agent runner.sh + wake-directive — Phase 1a LIVE (13 cron lines)
• Mac launchd kept for founder-machine morning jobs only (need local file writes)
• Hetzner owns ecosystem coordination crons going forward
• Two-way door — can roll back per-agent

Rejected: keep CronCreate (status quo) · all-launchd on Mac (still sleeps) · cloud functions (lock-in, cold-start, IAM, higher fixed cost).

Source: catie/decisions/2026-05-11_persistent_scheduler_v0.md

Secrets handling for the autonomous tier. Hetzner cron runners need credentials without exposing them. Pattern: read-from-vault-at-runtime, never bake into image, scope-down per job.

Source: catie/decisions/2026-05-11_credential_resilience_v0.md

8 of 10 substrate domains LOCKED. Third architecture audit in 48 hours (v1 → v2 → v3) — each with genuinely different headlines. v3 declared founder can shift focus from substrate to workflows.

Headline innovation: §1 binary LOCKED/IN-MOTION table — distinguishes "decided + shipped" from "still moving." Codified as Archie's first capability: archie/SKILLS/capability_1_ecosystem_audit_v0.md.

Source: catie/decisions/2026-05-10_architecture_audit_v3_snapshot.md

• DECISION_LOG.md — every decision, indexed
• VENDOR_PORTFOLIO_AUDIT.md — Cloudflare, Hetzner, Supabase, AWS, Neo4j, Vercel, Netlify with lock-in scores + escape paths
• AI_MODEL_STRATEGY.md — model-per-use-case matrix + 4 decision rules
• RISK_REGISTER.md — tracked risks with severity + mitigation owner
• CTO_COMPANION_TO_NORTH_STAR.md — strategic alignment with founder vision