Starting floor: RT already built pull-and-bank, so the gap is provider-push and S3 as a protocol
RT arrived at this topic having shipped a working object-storage system the day before
(2026-07-30): call audio pulled out of VAPI by a nightly cron into a private Vercel Blob store,
with a NULL column as the retry queue and audio-deleted-before-row ordering on the purge path
(automations/ghl-vapi-relay/lib/recording.js). So private-versus-public storage, retention
clocks, and idempotent sweeps are not new to him and should not be taught from scratch.
What is new, and what lesson 1 covers: the S3 API as a shared protocol rather than an Amazon
product, why that is the single test for whether an outside vendor can write into your bucket, and
the provider-push shape as an alternative to pulling. The non-obvious correction he was carrying in:
recordingUseCustomStorageEnabled already defaults to true, so the work is registering a credential,
not setting a flag; and Vercel Blob being built on Amazon S3 does not make it S3-compatible.
Implications. Lesson 2 is gated on an observation, not on more reading. Two facts the DuckyCutz
decision needs are undocumented: the object key VAPI writes into a custom bucket, and whether that
key comes back on the end-of-call-report webhook. Lesson 1 ends with a 20-minute sandbox
experiment to settle both. Do not design lesson 2 until RT reports the key string, because the
answer decides whether the topic goes towards presigned-URL playback (he must derive keys) or
towards a much shorter migration lesson (the webhook hands him the key and nothing needs deriving).