Add docs/adr/ with a chronological ADR set reconstructed from the project
history (no orchestrator, one storage format, derived-state sync,
SQL-over-SSH contract, WireGuard beneath SSH, IaC boundaries, non-root
image, runtime data paths, bounded lake scans), an index README, and a
template. Distinguish repo-local ADRs from ecosystem-wide ASRs.
Expand AGENTS.md with a decision-records section and a runtime/operations
guide (service URLs, rebuild workflow, CPU budget knobs). Reference the
ADRs from README, CONTRIBUTING, and the affected design docs, and add an
open question for T1 partition pruning.
Document why WireGuard and SSH are complementary layers, add Flux
boundaries for the ground segment, shared var/ data paths in docs/06,
and a contributor guide with the required test-first workflow.
Gitea Actions: compile check, virtual-drone smoke flight validated with
DuckDB, read-only SQL gate tests, Trivy vuln and misconfig scans. Pushes
to main cut a semantic version from the conventional-commit type and
publish a release with a fleet release manifest and source bundle.
Bench and flight share one query channel, so debugging exercises the
production path daily. Grafana/Prometheus/exporter host ports become
env-overridable for shared hosts.
Record the full reasoning path (GraphQL service, Arrow Flight, raw SSH,
forced-command synthesis) and specify read-only enforcement as five
fail-safe layers: key-per-operation, SELECT-only statement gate,
read-only OS user, engine hardening, resource caps. Promote 'SQL is
the contract' to a top-level design principle.
eSlider