Fat Cat Council Architecture — Proposal

Founder’s vision

A council of board-member-type agents (“Fat Cats”) that reviews, approves, and pushes back on operating decisions made by Ray (the COO agent). Five Fat Cats vote independently, output is consolidated, and founder + Ray retain ultimate operating say. The council is on-demand — Ray (or founder) calls a “weekly board meeting” rather than running it always-on. Diversity is a feature: each Fat Cat is powered by a different model provider so the council surfaces genuinely different reasoning, not five Claudes in trench coats.

Felix is a separate persona — IT support specialist, originally pitched as an on-device Mac mini agent in 2026-04-19-agentic-team-architecture. Founder is now reconsidering whether Felix should also live remote (less complicated than another tmux + watchdog + plist on the mini). This proposal treats Felix and the Fat Cat council as the same architectural problem (auxiliary persona spin-up) and proposes one substrate that handles both.

The founder’s hardware musings — Cloudflare workers + R2 (he said “R1”) + worker images with Claude Code pre-flashed — point at the right substrate. This proposal sharpens those into one specific recommendation.

Recommended architecture

One Cloudflare Worker per persona, built on the Cloudflare Agents SDK (Durable Object substrate), routed through the Vercel AI Gateway for multi-provider model access. R2 is the shared corpus (vault snapshot + decision specs); Durable Object SQLite is per-Fat-Cat working memory. Ray on the Mac mini invokes the council via authenticated HTTP fetch through Cloudflare Access (service token).

In one sentence: Fat Cats = Agent subclasses behind Cloudflare Access, using Vercel AI Gateway for provider diversity, with R2 for shared context and DO SQLite for per-cat memory.

Architecture details

flowchart TB
    subgraph MacMini["Mac mini (always-on)"]
        Ray["Ray COO agent (Claude Code in tmux)"]
    end

    subgraph CFEdge["Cloudflare Edge"]
        Access["Cloudflare Access<br/>(service token JWT)"]
        Router["board-router Worker<br/>fan-out + consolidation"]
        subgraph Council["Fat Cat Council (5x Agent DOs)"]
            FC1["FatCatAnthropic DO<br/>state: SQLite"]
            FC2["FatCatOpenAI DO<br/>state: SQLite"]
            FC3["FatCatGemini DO<br/>state: SQLite"]
            FC4["FatCatGrok DO<br/>state: SQLite"]
            FC5["FatCatOpen DO<br/>state: SQLite"]
        end
        Felix["Felix DO<br/>(same substrate, different posture)"]
        R2["R2: shared corpus<br/>vault snapshot, decision spec, RDCO principles"]
    end

    subgraph Providers["Model providers"]
        Gateway["Vercel AI Gateway<br/>(unified provider/model routing)"]
        Anthropic["Anthropic (claude-opus-4.7)"]
        OpenAI["OpenAI (gpt-5.4)"]
        Google["Google (gemini-3.x)"]
        XAI["xAI (grok-4)"]
        Open["Workers AI<br/>(llama-4 / qwen-3)"]
    end

    Ray -->|HTTPS POST<br/>+ CF-Access-Client-Id/Secret| Access
    Access --> Router
    Router -->|fan-out: getAgentByName| FC1 & FC2 & FC3 & FC4 & FC5
    Router -.callable.-> Felix
    FC1 & FC2 & FC3 & FC4 & FC5 -->|read context pack| R2
    FC1 & FC2 & FC3 & FC4 & FC5 -->|generateText| Gateway
    Gateway --> Anthropic & OpenAI & Google & XAI & Open
    FC1 & FC2 & FC3 & FC4 & FC5 -->|return vote + reasoning| Router
    Router -->|consolidated brief| Ray

Component responsibilities

• board-router Worker. Plain Worker (not a DO). Receives the meeting request from Ray. Loads the decision spec + context pack (R2 keys) into the prompt envelope. Fans out via getAgentByName(env.FatCatAnthropic, "session-<uuid>") etc. Consolidates the 5 votes into a single brief: majority position, dissent quotes, confidence spread. Writes the meeting transcript back to R2.
• FatCat<Provider> Agent class (5 instances of Agent<Env, FatCatState>). Each is a Durable Object class with its own SQLite. Per-cat state holds: persona prompt (e.g. “Anthropic-powered Fat Cat — leans risk-averse, Charlie-Munger-ish”), prior meeting context, the cat’s running track record. @callable() review(decisionSpec, contextPackKey) is the entry point. The cat reads its context pack from R2, runs generateText against its assigned provider via the gateway, returns { vote: "approve"|"object"|"defer", confidence: 0..1, reasoning: string, redlines: string[] }.
• Felix Agent class. Same substrate, narrow IT-support posture (Discord-only, no financial scope). Lives at /agents/felix/main. Page-able by Ray’s watchdog over HTTP instead of by tmux-pane heartbeat. Replaces the planned tmux-pane-on-Mac-mini Felix with a remote endpoint — simpler operational footprint, same role.
• R2 buckets. rdco-council-corpus (vault snapshot + RDCO operating principles, refreshed on a schedule from the Mac mini), rdco-council-meetings (decision specs in, transcripts out). Note: founder said “R1” but meant R2 — R1 is Cloudflare’s vector DB precursor; R2 is the S3-equivalent storage we already use in production for sc.raydata.co + hq.raydata.co.
• Vectorize (deferred). Optional Phase 3 — semantic search across the council corpus so each Fat Cat retrieves only the relevant slice of vault rather than getting the whole snapshot.
• Cloudflare Access. Already in production for hq.raydata.co. Gates the board-router endpoint with a service token (header pair CF-Access-Client-Id / CF-Access-Client-Secret) — Ray on the Mac mini holds the secret in 1Password.

How a meeting actually runs

1. Ray (Mac mini) prepares a decision spec (markdown: question, options, founder’s stated lean, vault refs). Uploads to R2 as meetings/<date>-<topic>/spec.md.
2. Ray POSTs to https://council.raydata.co/meet with the spec key + which cats to seat (default: all 5) + meeting type (review / approval / brainstorm).
3. board-router validates the Access JWT, loads the spec + the current corpus snapshot key, fans out to the 5 DOs in parallel. Each fan-out is a single getAgentByName(...).review(spec, corpusKey) call.
4. Each FatCat DO loads its persona, reads the context pack from R2, calls its assigned provider via the gateway. Returns within ~30s-90s.
5. board-router consolidates: tallies votes, extracts dissent quotes, surfaces redlines. Writes meetings/<date>-<topic>/transcript.md to R2 and returns the consolidated brief to Ray.
6. Ray relays the brief to founder (or files it to the vault, depending on meeting type). Founder makes the call.

Multi-provider strategy

Five seats, one model each. Why these:

Routing through Vercel AI Gateway. Single API key (OIDC-managed, no rotation), unified provider/model strings, automatic failover if a provider is down. Same gateway pattern RDCO already uses for surfaces. Cloudflare AI Gateway is a viable alternative (native to the Workers runtime) and we may want to layer it for caching + observability — defer that decision to Phase 2.

Failure mode: if a provider is down, the gateway returns an error; that seat votes defer rather than blocking the whole meeting. Quorum threshold is 3/5 voting (not deferring) for the meeting to count.

Cost estimate

Assumptions: weekly meeting cadence, ~50K input tokens / 5K output tokens per Fat Cat per meeting, 4 weeks/month.

Per meeting (5 cats, single round):

Monthly steady state (4 meetings/month, council only): ~$10-15.

Cloudflare infra (per month):

• Workers Paid plan: $5 (covers DO requests, CPU, R2 ops well within limits at this volume).
• R2 storage for corpus snapshots + transcripts: <1GB → effectively free tier.
• Cloudflare AI Gateway: free tier covers this volume.
• Workers AI: free tier covers the open-model seat at this cadence.

Phase 1 cost (single Fat Cat, single meeting): <$1 to prove the pattern.

All-in monthly at steady state: ~$15-20 for the council. If we add ad-hoc meetings (4-8 extra per month for bigger decisions), call it $30-40/mo. Cheap relative to RDCO’s existing tool spend.

Felix is essentially free incremental cost — same DO substrate, very low query volume (only fires on watchdog pages).

Implementation roadmap

Phase 1 — Single Fat Cat (1-2 evenings). One Worker, one DO class (FatCatAnthropic), no router, no fan-out, no Access. Ray invokes via local fetch with a shared secret in 1Password. Decision spec + context pack passed inline (no R2 yet). Goal: prove a remote Agent SDK persona can review a real RDCO decision and return a useful brief. Test decision: replay a recent founder choice (e.g., “should we run paid ads on Squarely”) and compare the cat’s review to what actually happened.

Phase 2 — Add R2 + Cloudflare Access (1 evening). Move corpus + decision specs to R2. Wire Cloudflare Access service token. Add the board-router Worker as a thin proxy (still single cat). Goal: clean separation between transport, auth, and reasoning; Ray invocation is one HTTPS call.

Phase 3 — Council of 5 (1-2 evenings). Add the four other FatCat<Provider> DO classes. Wire Vercel AI Gateway. Implement fan-out + consolidation in board-router. Personas sharpened per seat. Ship transcript-back-to-R2. Goal: weekly board meeting cadence becomes a real ritual.

Phase 4 — Felix on the same substrate (1 evening). Add Felix DO. Wire Discord webhook to invoke Felix instead of running Felix in a tmux pane on the Mac mini. Retire the Mac-mini-Felix plan from 2026-04-19-agentic-team-architecture. Goal: simpler operational footprint, one substrate for all auxiliary personas.

Phase 5 (optional) — Vectorize-backed retrieval. Index the vault into Vectorize so each cat retrieves only relevant slices. Reduces per-meeting token cost ~60%, sharpens responses. Goal: scale to daily / per-decision invocation cadence without cost concern.

Total elapsed: ~5-7 evenings of focused work to get to Phase 4. Phase 1 alone proves whether this pattern is worth the rest.

What this enables (L5-trajectory)

Mapping to the six L5 markers from Miura-Ko:

• Notices without being asked. Ray can be configured to auto-call a Fat Cat review on any decision above a threshold (e.g., any project Critical Component change, any spend >$X) without founder prompt. Today nothing reviews Ray’s calls except Ray.
• Synthesizes across sources. Five-provider council is synthesis-across-sources — different training corpora, different RLHF, different inductive biases. Consolidated brief is structurally a synthesis artifact.
• Decides whether action is warranted. Council quorum is the decision filter. 5/5 approve → Ray acts. 3-2 split → Ray escalates with the dissent transcript. Unanimous object → Ray drops it.
• Acts within delegated authority. The meeting type (“approval” vs “review” vs “brainstorm”) encodes the authority gate. Approval-type meetings have binding output; review-type are advisory.
• Escalates when uncertainty/consequence exceeds authority. Built into the consolidator: high dissent OR low-confidence-majority → auto-escalate to founder with the brief.
• Updates shared memory so future behavior improves. Every transcript lands in R2 + flows back into the vault snapshot on the next refresh. Cats see their own track record over time. The council compounds.

This is the unhobbling work the founder said he prioritizes (per project_l5_north_star_strategic_direction.md) — increasing toolset and visibility, not operating bets harder.

What’s deferred

• On-device Felix. Phase 4 explicitly retires the tmux-pane Felix plan. If the council substrate works for Fat Cats, Felix gets the same treatment. The bash watchdog + heartbeat plan from 2026-04-19-agentic-team-architecture for Ray still stands — that’s about Ray’s own self-recovery on the mini, not about Felix’s posture.
• Autonomous send paths. Council never writes outbound (no iMessage, no email, no Notion writes). It produces transcripts that Ray reads. Adding write authority to a remote agent is a separate decision.
• Real-time WebSocket connections. Agents SDK supports them but unnecessary for an on-demand HTTP-fan-out pattern. Defer until we have a use case.
• Felix Jr. The third-tier peer-watcher pattern from the v1 multi-agent doc. With Felix on Cloudflare, the recursion-floor logic changes — Cloudflare is the supervisor, no peer-watcher needed at that layer. Revisit if Felix-on-Cloudflare proves unstable.
• Founder-facing UI. No web dashboard for browsing past meetings yet. R2 + vault is enough for Phase 1-4. Possibly a small Pages site in Phase 5.

Alternatives considered + rejected

Open questions for founder

1. Provider diversity vs cost-control. Worth ~$20/mo for genuine cross-provider diversity? Or do we accept “5 Claudes with different personas” at near-zero incremental cost (cheaper, single-vendor, less interesting)? My read: pay for diversity — it’s the whole point.
2. Council seats — agree with the 5 chosen? Anthropic / OpenAI / Gemini / Grok / open-model. Specifically: is Grok worth a seat (outsider value) or is it bad-take risk that pollutes the brief (drop in favor of e.g. DeepSeek or Mistral)?
3. Felix posture. Confirm: move Felix to Cloudflare and retire the mini-pane Felix plan? Or run Felix in both places (mini for fast local diagnostics, Cloudflare as backup)? My lean: just Cloudflare — simpler.
4. Auto-invocation thresholds. Should the council auto-fire on any Critical Component change, any spend >$X, any new bet decision? Or strictly founder-/Ray-initiated for now? My lean: Phase 1-3 manual, Phase 4 add auto-fire with tight thresholds.
5. Service-token vs OAuth for Ray’s invocation. Service token is simpler (1Password-stored secret). OAuth adds friction but is the right pattern if we ever want founder-side direct invocation. My lean: service token now, revisit at Phase 4.

Appendix: relationship to existing v1 multi-agent architecture

2026-04-19-agentic-team-architecture designed a 3-agent on-device team (Ray + Felix + Felix Jr) for self-recovery — keeping Ray unstuck without founder in the loop. That problem is real and orthogonal: it’s about liveness of the COO process, not about quality of the COO’s decisions.

This proposal targets a different problem: decision quality + multi-perspective review. The two architectures coexist:

• Mac mini / on-device: bash watchdog + heartbeat hook keeps Ray alive (still planned).
• Cloudflare / remote: Fat Cat council reviews Ray’s decisions; Felix handles IT support remotely.

Net change vs the v1 doc: Felix moves from on-device to Cloudflare. Felix Jr is dropped (Cloudflare is the supervisor floor). The bash watchdog + heartbeat for Ray remains as planned.