06 — Decisions & evidence

Summary

The maintainer's file: ten decisions (up from six after the 18–19 Aug revision), each with a recommendation, none blocking P1/P3. And the evidence base that changed the spec: GitHub Pages sends access-control-allow-origin: * by default, so key-on-another-origin moved from 'probably unavailable' to 'supported, asserted at run time'; custody without access structurally requires a manifest, because every filename derives from the read key; object ids are sha256(ciphertext) with random IVs, so two vaults holding the same document share zero object ids — a fork is unlinkable; and Swagger UI measures 2.7× the vault it documents, which reversed decision 7 to a CDN-with-SRI default.

Key concepts

• Measurement over assumption — source-brief assumptions — and two of the pack's own — reversed by a curl and a spike, with reproduction steps
• The unlinkable fork — ciphertext-hashed ids + random IVs: a private fork of a public template is undetectable — a finding with privacy and attribution edges both ways
• A visibility default that drifts is a disclosure — decision 5's one-line rationale, worth keeping

Key ideas

• Every decision ships with a recommendation, so sign-off is a review, not a design session.
• Everything measured is reproducible from named scripts — the same dated, re-runnable discipline this site uses.

Read the document