Wrote up the case that Belo is really one agency brain wearing a software costume, and named the seam where a second vertical plugs in. Three new design docs (19 the mechanism, 20 the catalog, 21 a wedding companion PRD) plus ADR 0004, with the existing pipeline re-expressed as the software vertical so the refactor is a factoring not a rewrite. The wedding vertical is the forcing function: same propose-approve-commit spine, completely different substrate (vendor search, email, ElevenLabs voice, a task graph), and it even composes the software vertical to build the couple's RSVP site. Code-side it was a grab bag around making this safe to run: per-client secret storage in the operator console, inline-image ingestion with an SSRF guard and a streamed size cap, commit SHA on /health and at boot, a stronger egress allowlist with escalation, and a fix for the infinite restart loop.

12 commits across 1 repo (belo-works: 12). 38 files changed. Diff was truncated for summarization.