Manifesto: auto-recharge enabled with a healthy cap

manifesto.md

@@ -7,6 +7,7 @@ A fleet is agents. Dozens of them, coding, deploying, posting and fixing at the
 - We code in prod.
 - Root everywhere.
 - Our API keys are always "God Mode".
+- Auto-recharge enabled with a healthy cap.
 - No Kubernetes. No cloud shit. Bare metal only.
 - `--yolo` mode enabled.
 - We scale when we need to.
@@ -31,6 +32,8 @@ A fleet is agents. Dozens of them, coding, deploying, posting and fixing at the
 
 **Our API keys are always "God Mode".** A scoped key is a bet that you guessed next week's work correctly. Every key the fleet holds is the whole key: read, write, admin, delete. An agent that hits a permission wall at 3am stops, and a stopped agent is worth less than the blast radius you saved. Keys live in the vault, never in a .env, and the sysop rotates them when a box or a person leaves the fleet. If you cannot trust an agent with the whole key, do not hand it the box.
 
+**Auto-recharge enabled with a healthy cap.** Every account the fleet spends from tops itself back up without being asked. A balance that hits zero does not slow the fleet down, it stops all of it at once, mid deploy, and the sysop hears about it from a customer instead of a log. The cap is where the caution goes: high enough that a normal week never touches it, low enough that a runaway loop burns a number you can shrug at. Recharge off is not thrift, it is an outage scheduled for a quiet Sunday.
+
 **No Kubernetes. No cloud shit. Bare metal only.** The fleet runs on boxes with a hostname, a disk and an IP. Agents ssh in. Nobody writes YAML. Nobody rents a control plane.
 
 **`--yolo` mode enabled.** Every agent runs with the flag on. The sysop reads the transcript after, not the prompt before.