diff --git a/DECISIONS.md b/DECISIONS.md
new file mode 100644
index 0000000..88d4c12
--- /dev/null
+++ b/DECISIONS.md
@@ -0,0 +1,30 @@
+# Decision Log
+
+_Auto-generated by the Custodian State Hub._
+
+## Operate at build-stage security posture; defer production policy enforcement
+
+**Date:** 2026-07-02  
+**Decided by:** human  
+
+We are in build stage with the infrastructure as a whole. We will tighten security step by step but it is not yet strictly necessary.
+
+---
+
+## SECRETS-WP-0004 — approve warden-sign auth-capability lane prod apply
+
+**Date:** 2026-07-02  
+**Decided by:** human  
+
+I want to move to more automation, this is one step needed to go on.
+
+---
+
+## Defer consumer-side contract-parity drift mode (WHYNOT-WP-0003 T09)
+
+**Date:** 2026-07-02  
+**Decided by:** human  
+
+Sufficient for now
+
+---