ADR-001: Product boundaries

Status: accepted · Date: 2026-09-10

Context

The library is large, private, heterogeneous, and includes copyrighted material and offensive security procedures. The product must improve learning without becoming a distribution service or an autonomous operator.

Decision

Deadwire is a personal, local-first distillation and practice planner. It indexes supported documents, preserves provenance, proposes knowledge, builds a typed graph, and schedules evidence-producing practice. It does not redistribute source text, execute commands, infer authorization, replace labs, or claim mastery from reading.

Mechanics and tests

All external text is stored behind source references and access controls. Extracted commands carry unverified until a human records lab evidence. CLI tests assert that no adapter exposes a shell-execution operation. README and reports label planned versus measured behavior.

Consequences

Human review adds latency but prevents high-impact hallucinations and unsafe automation. Video transcription, cloud inference, PWA, autonomous labs, and fine-tuning remain deferred. Revisit only when privacy, licensing, and evidence controls are documented.

Alternatives considered

An autonomous operator was rejected because authorization cannot be inferred from a document and a mistake could affect a real system. A separate hosted summarizer was rejected because it would create an uncontrolled data path. The owner explicitly selects the host Codex CLI model and must apply the account data policy. A source mirror was rejected because it would create a second distribution channel. Deadwire instead emits short, original proposals and requires a person to approve canonical notes and authorize every lab.

Implementation detail and example

Every proposal has a provenance[], support_status, and verification_status. For example, a paragraph describing WinRM may become a proposal with support_status=source_supported and a command with verification_status=unverified; only a redacted lab record can change the latter to lab_verified. The tutor may explain the distinction, but it cannot run the command or promote the note.

Configuration and failure behavior

The default source root is the iCloud Hacking folder. Distillation runs through the host Codex CLI; LM Studio is an embeddings-only endpoint. All generated material is written to ignored staging until review. Unsupported formats are inventoried and marked deferred. Missing authorization, an unreadable source, invalid model output, or a provenance mismatch fails closed and creates a review record; it never silently downgrades to a less safe mode.

Verification and revisit trigger

Contract tests assert that adapters expose no shell-execution operation, that unverified commands cannot become approved without evidence, and that generated output contains no source excerpt beyond bounded command tokens. Revisit this boundary only after a written licensing, privacy, and authorization design proves that a broader capability is safe.