Decisions

Each record explains one decision: the context, what was decided, and what follows from it. Records are not rewritten when a decision changes. A new record replaces the old one and links back to it.

#	Decision
0001	The agency model: catalog, team, people, office
0002	Ports and adapters, one package per adapter
0003	The office is the only scheduler; agents connect out; the tracker is optional
0004	Trusted humans, with no owner role
0005	The catalog is baked into images and can be ejected
0006	A runtime-neutral permission policy
0007	The office store supports Postgres and SQLite
0008	Hosting and secret storage are out of scope
0009	The Claude Agent SDK is the primary runtime; the CLI is a fallback
0010	Each work item has its own context
0011	Workflows are configured, not hard-coded
0012	The project is licensed under the Apache License 2.0
0013	The subprocess sandbox is opt-in
0014	What the bubblewrap sandbox needs from a container
0015	Allow by default inside the sandbox, with a short list of hard denies
0016	One event pipeline with three decisions
0017	Network and identity are the boundary, not verbs per protocol
0018	The event pipeline is the only way the office decides
0019	Agents make the pipeline’s acts as themselves
0020	The office marks a ticket active for the agent when its work starts
0021	Merging is the agent’s decision, woken when its pull request may be ready
0022	The tracker’s echo of an act wakes no one
0023	A ticket closes once the checks on its merge commit pass
0024	Agent memory is kept behind ost note, on the volume or in the knowledge base
0025	Agents tell a human in chat when work lands on them