Archipelago — open-source initial import

2026-08-12 10:55:50 +00:00
commit 1e5d0cd313
1931 changed files with 440577 additions and 0 deletions
@@ -0,0 +1,66 @@
+# Synthesis Summary
+
+Ingest mode: new (fresh bootstrap; no existing PROJECT.md/REQUIREMENTS.md/ROADMAP.md)
+Synthesized: 2026-07-29
+Precedence applied: ADR > SPEC > PRD > DOC (no per-doc overrides)
+
+## Doc counts by type
+
+- ADR: 10 (all locked, Status: Accepted, confidence: high)
+- SPEC: 1 (confidence: high)
+- PRD: 0
+- DOC: 0
+- UNKNOWN: 0
+- Total: 11
+
+## Decisions locked (10)
+
+All in `intel/decisions.md`:
+- ADR-001 Podman over Docker — docs/adr/001-podman-over-docker.md
+- ADR-002 did:key (Ed25519) node identity — docs/adr/002-did-key-method.md
+- ADR-003 Nostr relays for node + app discovery — docs/adr/003-nostr-for-discovery.md
+- ADR-004 Tor hidden services for inter-node RPC/control plane — docs/adr/004-tor-for-peer-communication.md
+- ADR-005 ChaCha20-Poly1305 + Argon2id backup encryption — docs/adr/005-chacha20-backup-encryption.md
+- ADR-006 Nostr relays for marketplace discovery (trust tiers) — docs/adr/006-nostr-marketplace-discovery.md
+- ADR-007 Bilateral DID federation trust via single-use invite codes — docs/adr/007-did-federation-trust.md
+- ADR-008 Dual keys (Ed25519 + secp256k1) from one master seed — docs/adr/008-dual-key-strategy.md
+- ADR-009 Manifest-level container security enforcement — docs/adr/009-manifest-container-security.md
+- ADR-011 DWN deprioritization (Nostr + Tor federation instead) — docs/adr/011-dwn-deprioritization.md
+
+## Requirements extracted (0)
+
+No PRDs in ingest set. `intel/requirements.md` records the absence.
+
+## Constraints (7 entries)
+
+From docs/app-manifest-spec.md, in `intel/constraints.md`:
+- schema: 4 (top-level `app:` block, ContainerConfig, SecurityPolicy + validation, Volumes)
+- api-contract: 1 (lifecycle hooks)
+- protocol: 2 (Quadlet installation/reconciler semantics, distribution channels: signed catalog + Nostr marketplace)
+- nfr: 0
+
+## Context topics (0)
+
+No DOC-type documents. `intel/context.md` records the absence.
+
+## Conflicts
+
+- Blockers: 0
+- Competing variants: 0
+- Auto-resolved: 0
+- Informational notes: 4 (ADR-003/006 consistent overlap; SPEC validation narrower than ADR-009 mandates — silence, not contradiction; ADR-010 numbering gap; acyclic cross-ref graph)
+
+Detail: `.planning/INGEST-CONFLICTS.md`
+
+## Cycle detection
+
+Cross-ref graph acyclic (max depth well under cap). All 11 docs synthesized; no docs excluded.
+
+## Files
+
+- Decisions: `.planning/intel/decisions.md`
+- Requirements: `.planning/intel/requirements.md`
+- Constraints: `.planning/intel/constraints.md`
+- Context: `.planning/intel/context.md`
+- Conflict report: `.planning/INGEST-CONFLICTS.md`
+- Raw classifications: `.planning/intel/classifications/*.json`
@@ -0,0 +1,13 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/001-podman-over-docker.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-001: Podman Over Docker",
+  "summary": "Chose Podman over Docker as the container runtime for rootless, daemonless operation with native systemd integration.",
+  "scope": ["Podman", "Docker", "container runtime", "rootless containers", "systemd integration", "archy-net network"],
+  "cross_refs": [],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,13 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/002-did-key-method.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-002: DID Key Method for Node Identity",
+  "summary": "Chose did:key (Ed25519) as the primary DID method for node identity; self-contained and offline-capable, with federation trust lists mitigating rotation/revocation gaps.",
+  "scope": ["did:key", "node identity", "DID methods", "Ed25519 keys", "peer authentication", "federation trust lists", "verifiable credentials"],
+  "cross_refs": [],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,22 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/003-nostr-for-discovery.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-003: Nostr Relays for Node and App Discovery",
+  "summary": "Chose Nostr relays (NIP-78, kind 30078) for decentralized node discovery and marketplace app manifest distribution.",
+  "scope": [
+    "Nostr relays",
+    "node discovery",
+    "app discovery",
+    "marketplace app manifests",
+    "NIP-78",
+    "NIP-33 replaceable events",
+    "trust scoring",
+    "relay caching"
+  ],
+  "cross_refs": [],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,13 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/004-tor-for-peer-communication.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-004: Tor Hidden Services for Peer Communication",
+  "summary": "Chose Tor hidden services (.onion) for all inter-node RPC/control-plane communication; bulk data pulled from registries instead.",
+  "scope": ["Tor hidden services", "inter-node communication", "federation sync", "archy-tor container", "RPC/control plane", "NAT traversal"],
+  "cross_refs": [],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,13 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/005-chacha20-backup-encryption.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-005: ChaCha20-Poly1305 for Backup Encryption",
+  "summary": "Chose ChaCha20-Poly1305 AEAD with Argon2id key derivation for encrypting backups at rest, over AES-256-GCM and XChaCha20-Poly1305.",
+  "scope": ["backup encryption", "ChaCha20-Poly1305", "Argon2id key derivation", "AEAD", "nonce handling"],
+  "cross_refs": [],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,13 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/006-nostr-marketplace-discovery.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-006: Nostr Relays for Marketplace Discovery",
+  "summary": "Chose Nostr relays (NIP-78, kind 30078 events) for decentralized app manifest discovery instead of a centralized marketplace server.",
+  "scope": ["Nostr relays", "app manifest discovery", "marketplace", "trust scoring", "trust tiers", "manifest signature verification"],
+  "cross_refs": [],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,13 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/007-did-federation-trust.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-007: DID-Based Federation Trust",
+  "summary": "Chose bilateral DID-based verification with single-use invite codes over Tor for establishing federation trust between nodes, with Trusted/Observer/Untrusted levels.",
+  "scope": ["federation", "DID verification", "invite codes", "trust levels", "Tor hidden services", "Ed25519 keys"],
+  "cross_refs": ["ADR-003"],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,13 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/008-dual-key-strategy.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-008: Dual Key Strategy (Ed25519 + Secp256k1)",
+  "summary": "Maintain two key pairs per node identity: Ed25519 for DID/Web5 operations, secp256k1 for Nostr/Bitcoin/Lightning, both derived from one master seed.",
+  "scope": ["node identity", "Ed25519", "secp256k1", "DID documents", "verifiable credentials", "federation authentication", "backup encryption", "Nostr event publishing", "node discovery", "Lightning Network", "key derivation", "master seed"],
+  "cross_refs": [],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,13 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/009-manifest-container-security.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-009: Manifest-Level Container Security Enforcement",
+  "summary": "Enforce mandatory container security defaults (readonly root, no-new-privileges, non-root UID, dropped capabilities, pinned tags) at the manifest level during container creation.",
+  "scope": ["container security", "app manifests", "manifest validation", "podman container creation", "security defaults", "capability restrictions", "seccomp", "core/container module"],
+  "cross_refs": ["docs/app-manifest-spec.md", "core/container/src/", "core/security/src/"],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,13 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/adr/011-dwn-deprioritization.md",
+  "type": "ADR",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "ADR-011: DWN Deprioritization",
+  "summary": "Deprioritizes Web5 DWN spec compliance after TBD's shutdown; keeps existing custom DWN store code and prioritizes Nostr plus Tor federation for peer sync.",
+  "scope": ["DWN (Decentralized Web Node)", "Web5", "dwn_store.rs", "Nostr", "federation", "peer discovery", "peer data sync"],
+  "cross_refs": [],
+  "locked": true,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,29 @@
+{
+  "source_path": "/home/archipelago/Projects/archy/docs/app-manifest-spec.md",
+  "type": "SPEC",
+  "confidence": "high",
+  "manifest_override": false,
+  "title": "App Manifest Specification",
+  "summary": "Defines the declarative manifest.yml schema for apps: top-level fields, container config, security policy, volumes, hooks, installation semantics, and signed-catalog/marketplace distribution.",
+  "scope": [
+    "app manifest.yml schema",
+    "ContainerConfig (image/build, networks, derived_env, secret_env, generated_secrets, generated_certs)",
+    "SecurityPolicy (capabilities allow-list, network_policy, readonly_root)",
+    "volumes and bind-mount confinement",
+    "lifecycle hooks (post_install, pre_start)",
+    "health checks and interfaces",
+    "Quadlet installation and reconciler semantics",
+    "signed app catalog distribution",
+    "decentralized marketplace distribution"
+  ],
+  "cross_refs": [
+    "app-developer-guide.md",
+    "manifest-hooks-design.md",
+    "marketplace-protocol.md",
+    "core/container/src/manifest.rs",
+    "api/rpc/package/stacks.rs"
+  ],
+  "locked": false,
+  "precedence": null,
+  "notes": ""
+}
@@ -0,0 +1,38 @@
+# Constraints (from SPECs)
+
+Extracted from 1 classified SPEC: `docs/app-manifest-spec.md` (accurate as of 2026-07-08). The SPEC self-declares that the canonical schema is the Rust parser in `core/container/src/manifest.rs` — if doc and code disagree, the code wins.
+
+## App manifest top-level schema (`app:` block)
+- source: docs/app-manifest-spec.md
+- type: schema
+- content: Every app is a directory `apps/<id>/` with a `manifest.yml` containing a single top-level `app:` block. Apps are purely declarative — the orchestrator owns the entire lifecycle; no per-app installer code. Required fields: `id` (lowercase alphanumeric + `-`/`_`, must match directory name), `name`, `version`. Optional fields: `description`, `container` (ContainerConfig), `dependencies` (storage/app_id+version/bare string), `resources` (cpu_limit, memory_limit, disk_limit), `security` (SecurityPolicy), `ports` (host/container/protocol), `volumes`, `files` (GeneratedFile: path/content/overwrite; path must sit under a declared bind mount), `environment` (static KEY=value), `health_check` (type/endpoint/path/interval/timeout/retries; `http` is what the monitor exercises), `devices` (must start with `/dev/`), `interfaces` (launch surfaces keyed by name), `hooks` (LifecycleHooks). Unknown keys are absorbed into an `extensions` map (serde flatten) as transitional metadata — not typed schema, not validated.
+
+## ContainerConfig schema
+- source: docs/app-manifest-spec.md
+- type: schema
+- content: Exactly one of `image` or `build` must be present (image XOR build). Fields: `image` (registry reference), `image_signature` (optional), `pull_policy` (default `if-not-present`), `build` ({context, dockerfile default "Dockerfile", tag, build_args}), `network` (literal podman `--network` value; omitted = rootless default isolated network), `network_aliases` (extra DNS names on the network), `entrypoint`, `custom_args`, `derived_env` ({key, template} rendered against host facts at apply time; allowed placeholders only: {{HOST_IP}}, {{HOST_MDNS}}, {{DISK_GB}} plus dependency-resolved facts — never hard-code host specifics), `secret_env` ({key, secret_file} read from /var/lib/archipelago/secrets/<secret_file>, injected as a podman secret so it never appears in `podman inspect` or unit files; secret_file must be a bare filename, no `/` or `..`), `generated_secrets` ({name, kind} materialised by the orchestrator on first use, 0600, rootless service user, idempotent + self-healing; kind ∈ hex16|hex32|base64|bcrypt; bcrypt writes <name>=hash and <name>.pw=plaintext), `generated_certs` ({crt, key, common_name?, sans?} self-signed TLS materialised before create), `data_uid` ("UID:GID" applied to the app's bind-mounted data dir before create).
+
+## SecurityPolicy schema and validation rules
+- source: docs/app-manifest-spec.md
+- type: schema
+- content: Security block defaults: `readonly_root: true`, `no_new_privileges: true`, `capabilities: []` (cap-drop ALL, add back only listed), `network_policy: isolated` (isolated | bridge | host), `apparmor_profile: null` (optional). Validation enforced at `AppManifest::validate()`: capabilities must come from the reviewed allow-list (CHOWN, DAC_OVERRIDE, FOWNER, NET_ADMIN, NET_BIND_SERVICE, NET_RAW, SETGID, SETUID, SYS_ADMIN); `network_policy` must be exactly isolated/bridge/host; no `container:`/`ns:` network modes; devices must be `/dev/*`; bind-mount sources confined to `/var/lib/archipelago` (reviewed exceptions: rootless podman socket and dbus); `derived_env` templates limited to the placeholder allow-list; `secret_env`/`generated_secrets` names must be bare filenames; hook steps validated against the hook allow-list. (Note: the SPEC's documented validation list does not mention ADR-009's non-root UID, pinned-image-tag, or seccomp mandates — see INGEST-CONFLICTS.md INFO entry.)
+
+## Volumes schema
+- source: docs/app-manifest-spec.md
+- type: schema
+- content: Volume entries: `type` ∈ bind | volume | tmpfs; bind entries take `source` (confined to /var/lib/archipelago per validation), `target`, `options` from an allow-list (rw, ro, z, Z, shared, …); tmpfs entries take `target` and `tmpfs_options` (e.g. "rw,noexec,nosuid,size=256m").
+
+## Lifecycle hooks contract
+- source: docs/app-manifest-spec.md
+- type: api-contract
+- content: Hooks are declarative, allow-listed operations that run against the app's own container — never the host (design: manifest-hooks-design.md). `post_install` runs once after install with the container running; supported steps: `copy_from_host` (src relative to an allow-listed root — data dir / web-ui; no absolute paths, no '..') and `exec` (podman exec inside the container). `pre_start` is reserved in the schema; its executor is not yet wired.
+
+## Installation semantics (Quadlet + reconciler)
+- source: docs/app-manifest-spec.md
+- type: protocol
+- content: The orchestrator compiles the manifest into a rootless Podman Quadlet unit under `user.slice` — the container survives backend restarts and reboots. A level-triggered reconciler converges drift every 30 seconds. Multi-container apps are sets of per-member manifests installed together via the stack orchestrator (`api/rpc/package/stacks.rs`) on an app-local network.
+
+## Manifest distribution channels
+- source: docs/app-manifest-spec.md
+- type: protocol
+- content: Manifests ship two ways. (1) Signed catalog (primary): `releases/app-catalog.json` embeds the full manifest per app with an Ed25519 detached signature verified against the pinned release-root anchor; nodes overlay catalog manifests over disk files — catalog wins for image-only apps; `apps/<id>/manifest.yml` on disk remains the fallback and is still required for build-source apps. (2) Decentralized marketplace: Nostr NIP-78 discovery with DID-signed manifests (marketplace-protocol.md); the marketplace uses its own flatter manifest schema, not this one. Tooling: validate with `scripts/validate-app-manifest.sh`, regenerate catalog with `scripts/generate-app-catalog.py`, drift-checked in CI by `scripts/check-app-catalog-drift.py`.
@@ -0,0 +1,5 @@
+# Context (from DOCs)
+
+No DOC-type documents were present in the ingest set (10 ADRs + 1 SPEC). No context notes extracted.
+
+This file intentionally records absence rather than repurposing ADR/SPEC content as context.
@@ -0,0 +1,65 @@
+# Decisions (from ADRs)
+
+Extracted from 10 classified ADRs. All are `locked: true` (Status: Accepted) and cannot be auto-overridden by any lower-precedence source.
+
+## ADR-001: Podman Over Docker
+- source: docs/adr/001-podman-over-docker.md
+- status: locked (Accepted)
+- decision: Use Podman as the container runtime instead of Docker. Rootless by default, daemonless, Docker-compatible, native systemd integration, OCI-compliant. Use `archy-net` custom network for inter-container DNS.
+- scope: container runtime, rootless containers, systemd integration, archy-net network
+
+## ADR-002: DID Key Method for Node Identity
+- source: docs/adr/002-did-key-method.md
+- status: locked (Accepted)
+- decision: Use `did:key` (Ed25519) as the primary DID method for node identity. Self-contained, offline-capable, local resolution. Known gaps (no rotation, no service endpoints, no revocation) mitigated via federation trust lists and separately-stored service endpoints; future migration to did:peer/did:web possible if rotation is needed.
+- scope: node identity, DID methods, Ed25519 keys, peer authentication, federation trust lists, verifiable credentials
+
+## ADR-003: Nostr Relays for Node and App Discovery
+- source: docs/adr/003-nostr-for-discovery.md
+- status: locked (Accepted)
+- decision: Use Nostr relays (NIP-78, kind 30078) for both node discovery and marketplace app manifests. Query multiple relays in parallel with dedupe; local cache with 15-minute TTL; trust scoring (DID verification, relay consensus, federation trust); hashtag filtering (`archipelago-marketplace`); NIP-33 replaceable events for updates; Tor-compatible via SOCKS proxy.
+- scope: node discovery, app discovery, marketplace app manifests, NIP-78, NIP-33 replaceable events, trust scoring, relay caching
+
+## ADR-004: Tor Hidden Services for Peer Communication
+- source: docs/adr/004-tor-for-peer-communication.md
+- status: locked (Accepted)
+- decision: Use Tor hidden services (.onion addresses) for all inter-node communication. Scoped to RPC/control plane only — bulk data (container images) pulled from registries. Retry with backoff; `archy-tor` container runs automatically with host networking; federation sync interval (5 min) tolerates occasional failures.
+- scope: inter-node communication, federation sync, archy-tor container, RPC/control plane, NAT traversal
+
+## ADR-005: ChaCha20-Poly1305 for Backup Encryption
+- source: docs/adr/005-chacha20-backup-encryption.md
+- status: locked (Accepted)
+- decision: Use ChaCha20-Poly1305 (AEAD) with Argon2id key derivation for backup encryption at rest, chosen over AES-256-GCM and XChaCha20-Poly1305. Random nonce per backup stored alongside ciphertext; Argon2id with 64MB memory cost and 3 iterations for password-to-key derivation.
+- scope: backup encryption, AEAD, Argon2id key derivation, nonce handling
+
+## ADR-006: Nostr Relays for Marketplace Discovery
+- source: docs/adr/006-nostr-marketplace-discovery.md
+- status: locked (Accepted)
+- decision: Use Nostr relays (NIP-78, kind 30078 events) for decentralized app manifest discovery instead of a centralized marketplace server. Developers publish signed manifests to public relays; nodes query multiple relays; trust scoring via cross-relay verification count, DID-linked developer reputation, optional community endorsements. Trust tiers: Verified (known developer, 3+ relays, DID-verified), Community (2+ relays, valid manifest, unsigned/new developer), Unverified (single relay, new developer). Local relay-response caching; built-in curated list for essential apps; manifest signature verification before installation.
+- scope: marketplace, app manifest discovery, trust scoring, trust tiers, manifest signature verification
+
+## ADR-007: DID-Based Federation Trust
+- source: docs/adr/007-did-federation-trust.md
+- status: locked (Accepted)
+- decision: Use bilateral DID-based verification with single-use invite codes for federation trust establishment. Invite code carries DID, .onion address, and shared secret; exchanged out-of-band; both nodes verify DIDs via signed challenges over Tor; ongoing communication is DID-authenticated over Tor hidden services. Trust levels: Trusted (full access), Observer (read-only), Untrusted (blocked). Discovery (ADR-003) finds nodes; federation trusts them.
+- scope: federation, DID verification, invite codes, trust levels, Tor hidden services, Ed25519 keys
+- cross-refs: ADR-003
+
+## ADR-008: Dual Key Strategy (Ed25519 + Secp256k1)
+- source: docs/adr/008-dual-key-strategy.md
+- status: locked (Accepted)
+- decision: Maintain two key pairs per node identity, both derived from one master seed: Ed25519 as canonical identity (DID documents, verifiable credentials, federation auth, backup encryption via X25519 DH) and secp256k1 for Nostr/Bitcoin/Lightning (event publishing, node discovery, Lightning channel auth). Secp256k1 key linked to the DID via Nostr profile (NIP-05). Backup captures the master seed; DID document includes both verification methods.
+- scope: node identity, key derivation, master seed, Ed25519, secp256k1, DID documents, federation authentication, backup encryption, Nostr event publishing, node discovery, Lightning Network
+
+## ADR-009: Manifest-Level Container Security Enforcement
+- source: docs/adr/009-manifest-container-security.md
+- status: locked (Accepted)
+- decision: Enforce mandatory container security defaults at the manifest level, applied automatically during container creation. Non-negotiable defaults: `readonly_root: true`, `no_new_privileges: true`, non-root user (UID > 1000), drop ALL capabilities (add back only required), pinned image tags (no `latest`), default seccomp profile. `core/container/` validates manifests (parse → validate → reject violations → apply security context at `podman create`). Optional overrides (`readonly_root: false`, extra capabilities like NET_ADMIN) require explicit listing and documented justification, with audit trail.
+- scope: container security, app manifests, manifest validation, podman container creation, security defaults, capability restrictions, seccomp
+- cross-refs: docs/app-manifest-spec.md, core/container/src/, core/security/src/
+
+## ADR-011: DWN Deprioritization
+- source: docs/adr/011-dwn-deprioritization.md
+- status: locked (Accepted)
+- decision: Deprioritize Web5 DWN spec compliance following TBD's November 2024 shutdown. Keep existing custom DWN store code (`core/archipelago/src/network/dwn_store.rs`) for peer file catalogs and federation state; stop calling it "Web5 DWN" in user-facing text; do not invest in DWN spec compliance; prioritize Nostr + Tor federation for peer discovery and data exchange; re-evaluate only if DIF produces a viable Rust SDK or the spec regains maintainers.
+- scope: DWN, Web5, dwn_store.rs, Nostr, federation, peer discovery, peer data sync
@@ -0,0 +1,5 @@
+# Requirements (from PRDs)
+
+No PRD documents were present in the ingest set (10 ADRs + 1 SPEC). No requirements extracted.
+
+Downstream note: requirements for the roadmap must be derived elsewhere (e.g. from user input or a future PRD ingest); this file intentionally records absence rather than inferring requirements from ADR/SPEC content.