Why it works this way

Every design decision that could reasonably have gone the other way is recorded as an Architecture Decision Record, each with the reasoning and the cost. Start there if you are wondering why something is missing rather than how to use it.

Records live in docs/adr/ and are immutable in spirit: a decision that changes gets a new record and the old one is marked superseded. The history of what was believed, and when, is the reason to keep them.

Questions they answer

Shell only, with no language runtime — Accepted
Exit code 3 means the scan could not run — Accepted
Evidence lives in a temporary directory — Accepted
node_modules is not scanned — Accepted
Machine checks list recent changes only — Accepted
Scan roots are confirmed, not guessed — Accepted
Forks and archived repositories are in scope — Accepted
The sweep window starts two hours early — Accepted
A known actor escalates rather than dismisses — Accepted
Restore targets are read before they are offered — Accepted
Pre-attack commits are fetched, not assumed present — Accepted
The operator chooses how thorough cleaning is — Accepted
History rewriting uses filter-repo when it is installed — Accepted
The presentation layer holds no logic — Accepted
No AI attribution in the repository — Accepted
No external pager — Accepted
Long operations show git’s own progress — Accepted
Engines hide their standalone guidance when driven — Accepted
Restore is offered when possible, and explained when it is not — Accepted
A captured function prints only its value — Accepted
Only an explicit q leaves a prompt — Superseded by ADR-0022
q quits, b goes back — Accepted
The entry point parses before it runs — Accepted
A prompt inside a loop must not share its stdin — Accepted
Walk the filesystem once, with -prune, and checkpoint it — Accepted
2.0.0 is one binary, built against a conformance corpus — Accepted
Development and testing happen in a container — Accepted
The documentation site is Astro Starlight, on a Node toolchain — Accepted
Host state is read through one boundary, and can be supplied — Accepted
2.0 does not checkpoint a scan — Accepted
clean strips an appended payload in place, and never touches git — Accepted
The guided flow changes something only on a typed yes — Accepted
Every run opens with the banner, and colour changes no character — Accepted
The verdict is followed by what to do, and “rebuild” is said only on proof — Accepted
The guided flow is four calm screens, answered in words — Accepted
GitHub is checked through one boundary, and fixed one agreed way at a time — Accepted
A GitHub fix is planned on the copy, pushed on a yes, and believed when GitHub shows it — Accepted
Windows is read through the same boundary, with PowerShell as the tool — Accepted
The shell machine check is removed, and the corpus holds one engine — Accepted