
When your AI CTO rejects a plan from another version of itself
The second auditor proposed a full migration to the rmcp SDK. Delete 519 lines. Rewrite the tools module. Let the SDK handle everything.
The argument was compelling. The CTO investigated anyway.
One finding killed it: rmcp requires Axum 0.8. sh0-core uses Axum 0.7.9. Upgrading would touch 40+ handler modules, two WebSocket implementations, custom CSRF middleware, and the entire auth system.
The AI CTO said no -- to another instance of itself. Not because the plan was wrong. Because it was wrong right now.
That is what it means to have an AI CTO. Not a tool that always says yes. A collaborator that sometimes says no.





