bitlogin/.agents/memory/decisions.jsonl

{"kind":"decision","subject":"widget/key-custody","summary":"Private keys and derived secrets are confined to the crypto Web Worker (WASM/ArrayBuffer memory, shortest practical lifetime); the UI thread receives only public keys, signed events, and ciphertext — framed as surface minimization, not an absolute boundary, since a worker is not a security boundary against malicious same-origin code.","status":"active","evidence":[{"type":"repository","ref":"docs/spec.md"},{"type":"repository","ref":"AGENTS.md"}],"created":"2026-08-12","supersedes":[]}
{"kind":"decision","subject":"protocol/rollback-detection","summary":"Generation rollback against the device's local high-water mark fails closed by default (RollbackDetectedError) on login and password change, with an explicit acknowledgeRollback override for a merely lagging relay; a brand-new device with no high-water mark retains only the quorum defense.","status":"active","evidence":[{"type":"repository","ref":"docs/spec.md"},{"type":"repository","ref":"SECURITY.md"}],"created":"2026-08-12","supersedes":[]}
{"kind":"decision","subject":"distribution/vendored-widget","summary":"No CDN or npm release: consuming sites vendor the built widget into their own origin so no single compromised deploy can hit every integrator at once and every update passes a per-site review step; integration-visible changes are therefore recorded in CHANGELOG.md.","status":"active","evidence":[{"type":"repository","ref":"README.md"},{"type":"repository","ref":"CHANGELOG.md"}],"created":"2026-08-12","supersedes":[]}