Work Eddy
How Eddy was decided
20 decisions, month by month, from 13 Apr 2026 to 9 Oct 2026. Each is a written record of what was chosen and why, and the agents building Eddy read them before touching the code. 5 were written up afterwards, reconstructed from the plan, design notes and commit history.
Lightly edited for publication: personal details, places, private hostnames and internal references are removed. The reasoning is unchanged.
April 2026
6 decisions · 172 commits
- 13 AprOne codebase, two boxes: one moves bytes, one thinksOne codebase split across two machines by what each is good at, not by service boundaries.
- 13 AprEddy owns the video lifecycle; Plex and nginx only readEddy downloads, names and deletes its own files, so its own rules (like saved videos never being recycled) can’t be overridden by another tool.
- 13 AprOne notification channelEvery notification goes through one channel and one function, and a new technology replaces the old one rather than joining it.
- 13 AprKids’ viewing stays homeThe kids’ viewing history stays on the home server, and no outside service learns who watched what.
- 16 AprPeople are the subscription unitYou follow a person, not a channel, so one follow covers everything they make and everything they recommend carries their name.
- 29 AprAgents are infrastructure, not interfaceNo chat in front of the kids. AI works inside existing features or as calm, infrequent interjections; conversation is only for adults doing admin.
May 2026
4 decisions · 109 commits
- 16 MayA pick is explained or not shown; the creator’s title leadsNothing reaches the feed without a one-line reason in Eddy’s voice, and the card itself leads with the creator’s own title, never a rewritten hook.
- 20 MayDiscovery inputs must trace to a human actOnly a declaration or a follow can start a recommendation. What you watch can weight existing interests, but never invents new ones on its own.
- 22 MaySubscriptions and discovery compose one daily slatePeople you follow and discovery compete in one scored, capped pool. Discovery keeps reserved slots even on busy days, and a thin day stays short rather than padded.
- 31 MayKid follows are ungated; the guard at surfacing is the boundaryKids can follow creators without asking, because nothing a follow brings in reaches them without passing the guard first.
June 2026
1 decision · 15 commits
- 4 JunDiscovery metadata moves to the YouTube Data APISearches and channel lookups go through the official API so scraping traffic stops triggering YouTube’s bot detection, which was also blocking downloads.
July 2026
1 decision · 15 commits
- 20 JulDownloads are budgeted, demand-driven and stop when blockedAfter a multi-day block, downloads only happen when a video is actually chosen, within a daily budget, and the pipeline stops rather than keeps probing when blocked.
August 2026
No decisions · 4 commits
September 2026
5 decisions · 54 commits
- 19 SeptNative iOS is a thin shell; push is APNsThe iOS app wraps the existing web app and adds only what a web page can’t do, and push notifications carry an opaque id so nothing about the kids passes through Apple.
- 25 SeptGuard training labels come from a frontier teacher on a public poolA frontier model is to label public videos to train a small local guard; the family’s own decisions are used only to measure it, never to train it. Decided, not yet built.
- 25 SeptThe model describes; code decides; only an explicit clear yes reaches a kidThe local model scores a video against a safety rubric and never gives a verdict. A versioned table turns the scores into one for each age band, and every failure lands short of a yes.
- 25 SeptThe guard goes live in stages, and its labels come from real parent decisionsEnforcement switches on one source of kid content at a time, never by relaxing the targets, and the labels that measure the guard come from decisions a parent makes anyway.
- 25 SeptThumbnails are chosen and checked, never blurred or hot-linkedEvery image a kid could see on a card is picked from real frames and checked against the safety rubric before it’s shown, and if nothing passes, the card gets a plain placeholder.
October 2026
3 decisions · 16 commits
- 2 OctThe guard judges safety; the family judges tasteA 51% precision score was measuring two things at once, unsafe and not for us. Block now splits in two, and the guard is judged only on Unsafe.
- 2 OctGuard changes must beat the incumbent on a replay of parent decisionsA new prompt, rubric or model replaces the current guard only if it does better on the videos a parent has already judged, scored against labels that are never overwritten.
- 9 OctThe acting user comes from a device credential; a parent vouches for each deviceThe server works out who is acting from a credential held by each device, never from the request, and a device only gets one from an invite made at home.