Estate
Decisions Log
ADR-style record of the calls that shaped the estate, several amended by a council review round.
Situation
Each entry records a real decision in ADR style: context, what was chosen, why, and what was traded away, tagged adopted (live), direction (agreed, not fully built), or experiment (in flux). Several were revisited by a 2026-06-15 council review, most significantly D5 (memory topology), which reframes the original "Hermes as second canonical store" plan after it was found to undercut both the edge-local and vault-as-truth invariants.
The log also captures three decisions added directly from that review (D13 dev-driver security, D14 backup/DR, D15 edge data retention) plus a later one (D16) unblocking Tower-based deploys — together they form the backbone of the Round 1/2 roadmap priorities.
Key decisions
D1 — Edge-local invariant
The Worker reads only its own stores to answer a turn; the Hub/Hermes push inbound and poll. A home-infra outage degrades freshness, not availability — the core trade the whole estate is built around.
D2 — Recall via D1 FTS, not a vector store
SQLite FTS5 (BM25 + recency + hat-bias) is judged "good enough" for a personal corpus at zero extra infra cost; semantic search was deferred, accepting no paraphrase-only matching.
D5 — Memory topology reframed
The original "Hermes-canonical + edge-replica" design was rejected as a second canonical store inside a pre-1.0 dependency; the vault is now the single canonical source of truth, with Hermes's SQLite and the edge both derived/rebuildable and vault winning on conflict.
D6 — Owned-lane vault writes
Hub and Hermes write to disjoint path lanes with rebase/retry instead of locking; a council split led to keeping lanes but adding enforcement (a pre-commit/pre-receive hook) rather than moving to last-write-wins.
D9 — Conservative proactivity with priority override
Quiet hours, a daily soft cap, dedup, and mode-aware suppression by default; high priority can override up to a hard cap, low never interrupts — restraint protects trust.
D12 — Everything is PR-gated
All changes land via reviewed PRs with deliberate (never auto-merge) production deploys, trading deployment speed for quality gates without a team.
D13 — Autonomous dev-driver security model
The highest-severity Round 1 finding: bound Hermes's PR-opening blast radius with a dedicated bot identity, a repo-scoped token, branch protection, mandatory human approval, secret-safe CI, commit signing, and a read-untrusted/take-action gate, assuming the agent can be prompt-injected.
D14 — Backup, DR & operational safety net
Daily D1 + Hermes SQLite backups to R2, a tested rebuild runbook, a break-glass kit, per-cron dead-man's-switch heartbeats, and hard per-provider spend caps — recovery over redundancy for a solo operator.
docs/estate/05-decisions.md