app development context

docs/adr/0001-swift-native-host-with-local-sidecars.md

@@ -0,0 +1,3 @@
+# Swift-native host with local sidecars
+
+Mastermind's production runtime is a Swift/AppKit macOS host that owns UI, lifecycle, permissions, capture, policy, and storage. Local LLM and ASR processes stay behind loopback or Unix-socket protocols, while Electron is retained only as legacy reference; this keeps macOS capabilities native without forcing model runtimes into the application process.

docs/adr/0002-encrypted-observation-ledger.md

@@ -0,0 +1,3 @@
+# Encrypted observation ledger
+
+The Context Graph uses application-encrypted SQLite/SQLCipher as its source of truth. Collectors append immutable Observations, project versioned Assertions, and create Facts only through explicit user confirmation; this preserves Provenance and temporal conflicts while keeping full-text and vector indexes rebuildable instead of making a separate graph service authoritative.

docs/adr/0003-continuous-collectors-with-ephemeral-input.md

@@ -0,0 +1,3 @@
+# Continuous Collectors with ephemeral input
+
+Enabled screen, microphone, system-audio, workspace, calendar, and terminal Collectors run continuously and adapt to power and thermal pressure. Raw frames, audio, OCR, and full transcripts remain ephemeral while only structured local derivations persist; this trades recoverability for a strict local data-minimization boundary, so processor outages are recorded as Gaps rather than buffered raw content.

docs/adr/0004-defer-codex-until-no-tools-boundary.md

@@ -0,0 +1,3 @@
+# Defer Codex until a no-tools boundary exists
+
+Codex integration is excluded from the MVP even though it remains a future Provider direction. The official app-server is an agent protocol and its read-only sandbox does not provide a documented no-tools guarantee, so Mastermind will not ship OAuth, app-server code, or a hidden experimental path until a supported draft-only boundary can enforce the product's no-action contract.