Everything we run, and where each piece came from.

Our decisionDownloaded and used exactly as it comes. It removed a real limit — before this, work only happened while somebody sat at the keyboard. The only thing we added is a checklist to run before walking away, written after watching a detached run stall in silence for an hour.

The alternativeNo product to choose here. The alternative was sitting at the desk until the build finished.

Why we'd switchNothing. This one is settled.

CostFree — the phone app costs nothing.

MaintenanceNone.

Our decisionDownloaded the scheduler — running a loop on a timer is solved, and the day the vendor shipped one we cancelled the half of our own design that did the same thing. Built the walls, because nobody sells a cap and an audit trail we would trust on our own machine.

The alternativeWriting the whole thing ourselves — that was the original design, and half of it was cancelled on the day the vendor's scheduler shipped. Running the scheduler bare with no limits of our own — rejected: no stop switch, and no record of what it did while we slept.

Why we'd switch◉ The vendor's scheduler grows its own caps and audit hooks. Then our wrapper gets thinner again.

CostFree to us — the scheduler is part of the coding-assistant subscription above.

MaintenanceOur wrapper only. The scheduler half maintains itself.

Our decisionDownloaded the assistant — it is very good and gets better every month, and writing our own would be absurd. Wrote the launcher because we watched two real failures: identity leaking into the environment the assistant reads, and a session opened with the wrong permissions.

The alternativeOther coding assistants — GitHub Copilot, Cursor, Aider. All real and usable. The remaining option was writing everything by hand, which is rejected on purpose: this lab exists to learn how to hand work over safely, not to hand-carve code.

Why we'd switch◉ The assistant ships its own session registry and fleet controls. Then we delete the half of our launcher that overlaps.

CostPaid, monthly — one subscription. It is the lab's only recurring bill.

MaintenanceThe vendor ships changes often; the launcher needs a look when they do.

Our decisionBuilt ourselves, because it is a way of working rather than a product. Splitting the work by role makes authority readable: the designer cannot touch the live code, the builder cannot approve its own safety change, and the human signs off on every fork that matters.

The alternativeHosted platforms that run and coordinate AI agents for you — Amazon Bedrock Agents, OpenAI's Agents platform, LangGraph Platform. All real, and close to the shape we are rehearsing. Not used: they run the work on someone else's computers, and household detail would have to go there.

Why we'd switch◉ We prove unattended running works on our own machine, AND we find a job with no household detail in it. Then we pilot a hosted platform for that one job.

CostFree — it is a set of rules about who may do what.

MaintenanceHuman discipline: routing each piece of work to the right role.

Our decisionDownloaded the rendering engine, wrote the layouts. Rendering a page to paper is solved and worth nobody's time; the layout is the part that makes it our product.

The alternativeDrawing the page in code with a PDF library — ReportLab, PDFKit. Both real, and worse here: the same output for far more work.

Why we'd switchNothing.

CostFree — open-source libraries.

MaintenanceLow. The layouts change more often than the engine does.

Our decisionDownloaded the model, run it ourselves. Keeping anything a child touches on our own machine is a hard rule here, and running the model at home makes that a fact about the wiring instead of a promise in someone's terms of service.

The alternativeHosted model services — OpenAI, Google Gemini, Mistral. Faster and better at writing. Not used for anything that touches the household, because the text would have to leave the machine to get there. They are still used for design and planning work, where no family detail is involved.

Why we'd switch◉ A provider offers a promise we can actually verify that nothing is kept, AND the quality gap grows big enough that the family notices. Then we look again — one job at a time, not all at once.

CostFree — the model is free to download and it runs on hardware we already own.

MaintenanceOccasional: swap in a newer model. One hard ceiling — the machine's memory.

Our decisionBuilt it. This is the product, and it is also why the lab exists — we learn how to run AI agents by running this one every single day with a real family on the other end of it.

The alternativeBuying the experience instead: KiwiCo boxes, Khan Academy Kids, Highlights magazine. All real, all perfectly good. None of them teach you how to build a governed agent, and none of them will run our safety checks.

Why we'd switchNothing. Building it is the point.

CostFree — our own code on hardware we already own.

MaintenanceConstant. It is the thing we keep improving.

Our decisionBuilt it. Being safe around kids is a condition of running at all, not a feature we score out of ten. An instruction written to a model is a request; code is a rule. This is code.

The alternativeContent-moderation services — OpenAI's moderation endpoint, Google's Perspective API, Azure AI Content Safety. All real, all rejected here: they catch general nastiness, not "this household does not do hot glue guns", and this check has to run where the data already is.

Why we'd switchNothing for the check itself. The models it screens with can be swapped out freely.

CostFree — our own code.

MaintenanceRevised whenever the approved list is signed off again.

Our decisionBuilt. "It does not repeat" is the family's actual quality bar, and no product on earth knows our history or our theme list.

The alternativeNo product to choose. The alternative was writing "please be varied" into the instructions and hoping — which cannot be checked, so it is not a control.

Why we'd switchNothing.

CostFree — our own code.

MaintenanceLow.

Our decisionThe human writes this one, not the AI. Where the question is what a child gets exposed to, a person has to be the author. An agent may set up the file format and nothing else.

The alternativeLetting the AI draft the list and having a person approve it. Real, common, and rejected: approving a list you did not write is rubber-stamping, and this is the last place you want that.

Why we'd switchNothing. A person writes this one, permanently.

CostFree — human time.

MaintenanceThe human re-reads and re-signs it periodically.

Our decisionBuilt. Picking varied cards is only as good as the labels underneath them, so "the labels work" had to be something we could check rather than something we assumed.

The alternativeLetting a model compare activities by meaning and drop the near-duplicates — the standard approach, and every vector database sells it. Put off: a parent cannot inspect why two things were judged similar, and at a few hundred activities it is more machinery than the problem needs.

Why we'd switch◉ Labels keep coming out wrong even after we tidy them up. Then a model gets to suggest a label — as a hint, never as the decider.

CostFree — our own code.

MaintenancePeriodic tidying as the activity bank grows.

Our decisionDownloaded and used as it comes. The vendor already runs the search; our only job is keeping our folder in sync with it. Building a second search engine for a few hundred documents would be work with nothing at the end of it.

The alternativeRunning our own search: a vector database — Pinecone, Chroma, or Postgres with the pgvector extension — behind a model that turns text into numbers. Real, and deliberately not built. It waits on a condition, not on enthusiasm.

Why we'd switch◉ Keeping the uploaded copy current between sessions becomes the thing that slows us down. Then we move to the direct read service below.

CostFree to us — included in the assistant subscription we already pay for.

MaintenanceOne sync step.

Our decisionDownloaded the standard, wrote the server — a few hundred lines, read-only. The real problem was that knowledge only crossed between tools when a human carried it, which is why most of our design documents were written once and never read again. An open standard fixes that without betting the lab on one company's app.

The alternativeLetting the assistant's app read the folder itself — tried, and it broke every time the app changed. A hosted connector — real, and it needs our machine reachable from the public internet, so it waits behind its own condition. Doing nothing — that was the situation this replaced.

Why we'd switch◉ People are still pasting documents around after this lands, or we keep needing it from a phone. Then we put up a hardened public address and use a hosted connector.

CostFree — an open standard and our own small server.

MaintenanceLow. Two or three read-only commands.

Our decisionDownloaded the file format — it is an open standard several assistants read — and wrote the content ourselves. Attention is the scarce thing here: the handoff makes losing a session cheap, and the how-to files mean a hard-won procedure gets loaded rather than learned again.

The alternativeLeaning on the assistant's own memory feature. Real, and not enough on its own — it does not carry the precise state one working session needs to hand to the next.

Why we'd switch◉ Assistant memory gets good enough to carry state between different tools. Then the written ritual gets shorter.

CostFree.

MaintenanceHuman discipline at the end of every session.

Our decisionBuilt. The problem was never storing things; it was finding them. With no index, working a design out again from scratch was cheaper than locating the one we had already written. The index flips that around.

The alternativeObsidian and Logseq — real, and they help a person read notes while giving an AI nothing. Notion and Confluence — a second place for documents to live, which means two versions of the truth. A search index built on embeddings — the assistant already provides one, listed below.

Why we'd switch◉ More than 500 documents, or three separate times we go looking and fail to find something. Then we add a search layer on top — as a hint, not as the index.

CostFree — a folder, a header convention, and one script.

MaintenanceOngoing discipline: every document gets its header.

Our decisionBuilt, and it is not really a code reviewer — it is an experiment in whether an AI control can be trusted with real power. It may block a save only after 25 or more graded cases show it agrees with a person, and with a stricter bar for the kind of mistake that matters most: waving something through that should have been stopped.

The alternativeCodeRabbit, Greptile, and GitHub's own AI review. All real. They give you an opinion with no record of whether that opinion was ever right, and they work on pull requests, which this lab does not use. We would run one later as a second opinion, to build up evidence faster.

Why we'd switch◉ The code gets pushed to a hosted server. Then we add a commercial reviewer as a second stream of evidence.

CostFree — it uses the model already running on our own machine.

MaintenanceA steady drip of human grading.

Our decisionBuilt. The checks themselves are the valuable part — they are the floor everything else here stands on. The tools that run checks are just runners; the rules are ours.

The alternativepre-commit and Husky — real, widely used frameworks for exactly this job. They add a dependency and zero new checks; we would still be writing every rule ourselves. GitHub Actions — real, but it runs after the code has already been sent away, which is the wrong moment, and it needs a server we do not have.

Why we'd switch◉ More than ten checks, or a second codebase under the same rules. Then we adopt pre-commit as the runner and keep our own checks inside it.

CostFree — our own code, run by version control.

MaintenanceOccasional fixes when a check gets something wrong.

Our decisionBuilt. Deciding by condition instead of by date is how we stop re-arguing the same tool choice every month — and a condition nobody watches is decoration, so something watches them.

The alternativeNo product to choose. The alternatives were a roadmap document and a calendar reminder. Dates lie, and documents go unread.

Why we'd switchNothing. This is the thing that decides when everything else switches.

CostFree — one file and a script.

MaintenanceLow.

Our decisionBuilt. No accounts, nothing leaves the machine, the board sits beside the code it describes, and every edit passes the same gates. The board is inside the fence rather than parked next to it.

The alternativeGitHub Issues and Projects — free, with a good interface for programs, labels, a phone app, and an official connector for AI tools. It is the strongest thing we keep saying no to, and it is what we will move to. Also real: Jira, Linear, Trello — more ceremony than a one-person lab needs. A fancier home-made version of this was designed and then cancelled in favour of moving to GitHub Issues when the time comes.

Why we'd switch◉ More than 300 open rows, or a third time the file reader breaks, or a second person joins. Then we move to GitHub Issues — not to a bigger home-made thing.

CostFree — a text file and a script.

MaintenanceThe file reader is the weak point. It has broken before.

Our decisionBuilt, after a real leak. Secret scanners look for passwords and access keys. Not one of them notices a birthday in a test fixture, which is exactly what got through.

The alternativegitleaks and TruffleHog — both real, both good, both solving a different problem. We would add one alongside this, never instead of it, the day this code goes to a hosted server.

Why we'd switch◉ The code gets pushed to a hosted server anywhere. Then we add a full history scan for passwords and keys next to this one.

CostFree — our own code.

MaintenanceTuning, whenever it flags something harmless.

Our decisionSet up ourselves out of what the operating system already provides. Containment has to be built into the wiring — if the only thing stopping an agent is its instructions, nothing is stopping it. Getting more power requires a deliberate step by a human.

The alternativeDocker containers or a virtual machine — both real, and genuinely stronger in places. Heavier to run, and they hide the lesson this lab exists to teach. Vendor sandboxes that run your code for you — the code would leave the machine, which is the line we do not cross here.

Why we'd switch◉ We ever run work for someone outside the household. Then logins are not enough and each tenant needs real isolation.

CostFree — logins the operating system already offers.

MaintenanceLow, once it is set up.

Our decisionA rule we hold ourselves to. Separating who does the work from who approves it is what makes handing work to an agent safe at all. Approving everything up front is defensible only where the action can be undone, stays inside the codebase, and already passes the checks above.

The alternativeThe full auto-approve mode every AI coding tool now offers. Real, and used here on purpose inside the guarded codebase, where the checks catch the mistakes. Refused on anything that reaches the live product.

Why we'd switch◉ One specific check builds up a track record good enough to earn it. Then that one approval becomes automatic — one at a time, never all of them at once.

CostFree, but it costs human attention. The price rises with how much damage the action could do.

MaintenanceOngoing human attention.

Our decisionDownloaded and used exactly as it comes. A mature product does this well, costs nothing at our size, and there is nothing to learn by building it ourselves.

The alternativeOpening a port on the home router and forwarding it in — real, and worse in every direction. Building the private network by hand with something like WireGuard or OpenVPN — real, and more work for the same result with more ways to get it wrong.

Why we'd switch◉ We ever put a public address on a product. That is a different problem and gets its own tools.

CostFree — the personal tier covers a household.

MaintenanceNone.

Our decisionDownloaded the sending part — email is a solved protocol and we send through an ordinary mailbox. Wrote the gate around it: what is allowed to go out, when it may go, and the line it writes in the log afterwards.

The alternativePush-notification and messaging services — Pushover, Twilio, a Slack or Telegram bot. All real. Rejected for now: another account and another interface to learn for something one email already does.

Why we'd switch◉ We ever send to a second family. Then we move to a proper bulk email service — Postmark, Mailgun, or Amazon SES — for delivery rates and a working unsubscribe link.

CostFree — it sends through an email account the household already has.

MaintenanceCredentials, and an occasional check that the mail is still arriving.

Our decisionBuilt. Moving files between two logins on one machine, under a strict limit on what may be elevated, is not a shape any ready-made tool has. The read-back is not optional: we caught this program reporting success once when it had written nothing at all.

The alternativeAnsible — real, and built for managing fleets of servers, which is not one machine in a house. Make — real, and it can run the steps but cannot verify them. GitHub Actions or any similar service — real, and it needs a hosted server plus a level of access we deliberately do not grant.

Why we'd switch◉ A second machine joins. Then it is worth looking at proper configuration-management tools.

CostFree — our own code.

MaintenanceLow.

Our decisionBuilt, thinly, on top of version control. One machine holding everything was the single biggest risk here. Making the laptop pull, rather than the machine push, gets a copy off the premises without opening anything new. And the restore drill searches the restored history for personal detail before we trust it.

The alternativeA hosted code host — GitHub, GitLab, Bitbucket. Free, obvious, and deliberately put off: sending a full history somewhere is a door that does not close again, so it waits until that history has been scanned for personal detail.

Why we'd switch◉ Any real need for a hosted copy — a collaborator, automated testing, code review. Then we get a private hosted repository, after the scan.

CostFree — hardware we already own.

MaintenanceA glance at the log.

Our decisionBuilt. A hand-typed number becomes a lie the moment the thing it describes changes, so every figure here is either worked out from the logs or simply absent. At this size, a page generator is cheaper than running a monitoring system.

The alternativeGrafana — real, and the standard answer to this. It means running a resident service and a database connection on a machine that should be running almost nothing. It is waiting on the condition below.

Why we'd switch◉ The logs move into a database AND we pass twelve panels. Then Grafana.

CostFree — our own code.

MaintenanceThe page generator needs updating as the logs change shape.

Our decisionA convention we hold ourselves to. An audit trail should be boring: text you can open in anything, compare in version control, and search with one command. The trail is the thing we are actually building.

The alternativeSQLite — real, and much better for asking complicated questions. Worse to read, and it puts a file you cannot eyeball into a codebase where every change is reviewed as text. When we adopt it, it will read these files rather than replace them.

Why we'd switch◉ A third time we need to cross-reference two logs, or any single log passes 50,000 lines. Then SQLite reads them alongside.

CostFree — text files.

MaintenanceLow.

Our decisionBuilt, and it is about 200 lines. Saving links is a commodity. Grading them against our own plan is not something anybody can sell you.

The alternativeReadwise Reader, Instapaper, Pocket, and a Notion database. All real, all good at saving and labelling. Not one of them makes a judgement, and each adds a cloud account we do not want.

Why we'd switch◉ A second person joins and starts saving links too. Then we need a shared inbox rather than a personal one.

CostFree — our own code, using the model already on the machine.

MaintenanceLow.