The org's decision why-trail — every standing call, who made it, and what replaced what. This is what the fleet reads before it types.
Customers open exports in Excel/Sheets; unquoted commas silently shift columns and corrupt data. Quote-and-double-escape every field containing a comma, double-quote, CR, or LF. Line terminator stays CRLF.
Local-timezone exports were ambiguous once shared across regions. Emit ISO-8601 UTC with a trailing offset so a row is unambiguous no matter who opens it. Supersedes decision #96.
Dispatch stays credible and portable by never naming the underlying model providers in the interface. Effort is shown as neutral tiers.
The product gathers proof-of-work (tests, a walkthrough, per-candidate results) and RANKS a human's attention. It never asserts a change is correct or done. Every merge is a human sign-off.
Large lists virtualize; the console never mounts every row. Applies to runs, decisions, and audit tables.
Across the routing eval, a single house model under-generated on hard tasks but reviewed candidates well. Use it to select/verify; let a diversified fleet generate.
Spend cheaply first, escalate only on earned failure. A behavioral gate climbs the rung ladder; a syntax gate generates a diversified N once, filters broken candidates, and a reviewer suggests a winner for the human.
Any endpoint authorized by a guessable token needs a throttle in front of the row lookup so it can't be brute-forced.
Token-authorized paths bypass row-level security. Every such handler must re-derive the organization from the trusted record (the invite, the seat), never from a request parameter.
Original call: show times in the reader's local zone for friendliness. Retired — ambiguous across regions once exports are shared.