Decision Log — Public
Subset of architectural, product, and methodology decisions safe for the public surface. Commercial decisions (pricing, JV structure, partner split) and internal stakeholder reviews live in the vault, not here. Most recent first.
2026-05-14 · Mirror — build-time editorial layer for th.cone.red
Context: The site renders the vault to th.cone.red on every commit. As the vault matured it accumulated internal context (specific dollar amounts, stakeholder names, transcript paraphrases) that shouldn't be on the public surface.
Chosen: Build a curation layer between the vault and the site. The vault stays raw and honest; a build-time editorial pass produces a active/curated/ mirror that is the only thing the site reads. Default-deny: if a file isn't explicitly curated, it isn't published.
The Methodology page evolves into a coordination surface — three states (pre-1:1 agenda → live editing → post-call published). Mike and Dima maintain it jointly during their working sessions.
Why this shape: Separation of vault-truth from publish-truth lets the vault stay honest without leaking; the coordination surface turns the website into the meeting structure tool, not just a publish target.
2026-05-11 · th.cone.red hosts on Cloudflare Pages
Context: The repo is private. GitHub Pages requires a paid plan for private repos; Cloudflare Pages is free and integrates with private repos via GitHub App.
Chosen: Cloudflare Pages. Same DNS as the rest of cone.red. Auto-deploys ~30s after every push to main. CNAME + custom domain configured at the Cloudflare dashboard.
2026-05-06 · Encryption at rest — hybrid posture
Context: Pilot Zero data includes the most sensitive content the product will ever handle: soul-discovery prompts, generated Soul documents, communication guides.
Chosen: Column-level pgcrypto encryption on the three highest-sensitivity columns (soul_documents content, communication_guides content, raw user uploads). Volume-level encryption deferred — operational cost too high at Pilot Zero scale, and the columns that matter are protected.
Why: Strongest defensible story at the lowest cost. An attacker who reads the disk gets gibberish for the values that matter most. The pgcrypto extension is already wired in the initial schema; the dependency cost is zero.
2026-05-04 · Helicone — self-hosted, not SaaS
Context: Helicone is the LLM cost-telemetry proxy. The SaaS posture would mean soul-discovery prompts and completions transit Helicone servers.
Chosen: Self-host Helicone inside Cone Red infrastructure. No soul-discovery telemetry leaves our boundary. Matches the architectural principle: "soul-discovery data should not phone home."
Trade: ~1 day of self-hosting setup against an indefinitely cleaner trust story with pilots and future enterprise customers.
2026-04-28 · Phase 1 deploys on existing Cone Red shared VPS + Docker + Traefik
Context: Reversal of the April 27 Hetzner-single-VM decision. Cone Red already operates a shared VPS with Postgres + Traefik in production for other workloads; the same substrate serves Phase 1 with zero new infrastructure.
Chosen: Postgres 17 + pgvector + Redis + Langfuse all run as Docker containers on the shared VPS behind Traefik. No public ports on backend services. Drops AWS RDS, KMS, S3, ECR dependencies. Gains: zero new monthly infrastructure cost, simpler ops, consistency with other CR workloads.
2026-04-25 · US-only scope for Phase 1
Context: Methodology design and pilot recruiting are US-focused. GDPR + EU AI Act compliance code-work would consume significant Phase 1 capacity for zero pilot benefit.
Chosen: US-only data residency for Phase 1. Privacy-by-design principles stay (column-level encryption, audit logging, consent records schema); compliance code-work (DSR endpoints, right-to-erasure flows, AI Act risk classification) deferred to post-launch when EU pilots come into scope.
Revisit triggers: any non-US pilot inquiry; explicit Doug request to position for EU at launch.
2026-04-25 · Build agent ≠ verify agent — durable methodology rule
Context: The team uses Claude Code agents both to write code and to verify it. Running both with the same agent creates confirmation bias — the agent that just wrote the code has implicit trust in its own output.
Chosen: A durable methodology rule: the agent that builds a piece of work is never the agent that verifies it. Verification runs in an isolated worktree via the Agent tool. Anti-confirmation-bias is enforced by tooling, not discipline.
Why this matters publicly: This is one of the practices that makes the work auditable for partners who care about how AI-assisted engineering actually gets done. It's also the kind of rule that's easy to talk about and hard to enforce — wiring it into the tooling makes it real.
2026-04-15 · Phase 1 commercial structure — JV, not vendor-client
Context: April 3 was the inflection conversation: Doug shifted from "interesting potential project" to "I'm committed to this." The structure question that followed: vendor engagement (one-time deliverable) or joint venture (long-term partnership with shared upside).
Chosen: Joint venture. Phase 1 capital committed; long-term partnership formed; shared upside on Phase 2 (Dashboard) and beyond. Specific terms (entity, revenue split, recoup, IP ownership) ratified April 15 and finalized in the JV operating agreement.
Why this matters publicly: the JV frame is why this is a multi-year build, not a contract job. The team builds for long-term flourishing, not for a delivery handoff.
Internal pricing decisions, partner-split mechanics, and stakeholder briefing items are tracked in the vault and not surfaced here.