Storage & Asset Architecture — final decision (lean)

Status: decided 2026-06-01. Principle: the publish layer reads addressable URLs, never embeds blobs · keep the cloud footprint to the absolute minimum · content is generated and lives on-device by default.

The lean stack

Layer	Store	Why
Source / composition / code — blog `.md`, calendar YAML, storyboards, registry, manifests	GitHub (this repo)	Free, versioned, the source of truth the harness reads.
4K masters · raw · working renders	On-device (+ a backup drive)	Generated locally; manual handoff when a human needs them. Never in git (100 MB limit, bloat).
Blog images on temerarii.com	Duda (native asset hosting)	The blog CMS hosts its own images — no external media host needed for the blog.
Publish-grade social video / email images	Cloudinary (cloud `dyd14xqtg`, free tier)	The one external service, and only because Blotato pulls media by URL — it can't fetch from your device or a private repo. A thin public video/image URL host.

What we are NOT using

Box — killed. Its only role was 4K archive + human handoff; 4K now stays on-device with manual handoff, so Box adds cost (enterprise CCG) and maintenance for no need. The dormant box entry in .claude/mcp.json can be removed; no Box integration is wired.
No transform dependency on Cloudinary. We pre-render the 9 platform formats on-device, so Cloudinary is a dumb URL host, not a transform engine. That keeps us on the free tier and swap-able.

Hard rules

Cloudinary is delivery only — publish-grade renders uploaded for a public URL Blotato/email can fetch. 4K never goes to Cloudinary (free tier is ~25 GB; --skip-4k on the publish render).
Binaries never go in git. Renders/masters stay on-device + (only what's published) on Cloudinary.
Secrets live in gitignored .env only.

Future levers (drop to zero external services)

If Blotato can ingest by direct upload (file, not URL), or we serve published videos from our own backend, Cloudinary becomes optional → the machine runs on-device + GitHub + Duda with zero media cloud.
If email egress ever grows, swap Cloudinary → Cloudflare R2 (free egress; already on Cloudflare).

Autonomy note (the real risk, not storage)

A scheduled autonomous publisher shouldn't depend on the laptop being awake. Run the scheduler on GitHub Actions (free cron) or a cheap always-on runner so the machine fires on time regardless of the device.

Conventions

Cloudinary delivery folder: studio/<brand>/<week>/<type>.
On-device working/masters: kept in the render output tree; backed up off-device.
Produce on-device → upload only publish-grade to Cloudinary → store the delivery URL on the cell → publish reads that URL. Blog → Duda API (images hosted by Duda).