micahflee · Oct 11, 2026 · Oct 11, 2026 · Oct 11, 2026
diff --git a/docs/adr/0001-bidirectional-cyd-archive-compatibility.md b/docs/adr/0001-bidirectional-cyd-archive-compatibility.md
diff --git a/docs/adr/0001-shared-cyd-bluesky-archive-format.md b/docs/adr/0001-shared-cyd-bluesky-archive-format.md
@@ -0,0 +1,7 @@
+# ADR 0001: Shared Cyd Bluesky archive format
+
+Cyd and Cyd Mobile share one Bluesky archive format for import, export, and
+recovery. The normative contract is `docs/archive/bluesky/v2/` in this repo —
+its README, SQLite schema, and canonical fixtures are the single source of
+truth, mirrored into Cyd Mobile as a pinned contract bundle. Conformance is
+enforced by tests in both repos, not by prose.
diff --git a/docs/adr/0002-canonical-archive-interchange-database.md b/docs/adr/0002-canonical-archive-interchange-database.md
diff --git a/docs/adr/0002-protect-credentials-only.md b/docs/adr/0002-protect-credentials-only.md
@@ -0,0 +1,14 @@
+# ADR 0002: Protect credentials only, with disclosure
+
+Credentials for every platform — Bluesky OAuth sessions, X and Facebook
+browser sessions, and anything else that authorizes account control — are
+stored outside every account database, media directory, and archive through
+the desktop-wide credential facility, which uses OS-protected storage
+wherever one is available. Where none is, it stores the credential in the
+clear in the same owner-only vault and tells the user so, rather than
+refusing to persist it. Saved content relies on operating-system account
+permissions and disk encryption; credentials are the exception because they
+authorize account control. Bluesky connects through OAuth rather than app
+passwords, and Cyd holds one Bluesky OAuth session per DID, shared by every
+account acting on that identity, deriving its holders from account state so
+a session is revoked at the PDS only when the last holder disconnects.
diff --git a/docs/adr/0003-bluesky-durable-jobs-and-content-addressed-storage.md b/docs/adr/0003-bluesky-durable-jobs-and-content-addressed-storage.md
@@ -0,0 +1,12 @@
+# ADR 0003: Bluesky durable jobs and content-addressed storage
+
+Bluesky save, delete, import, and export operations are durable, resumable,
+and idempotent: they commit progress incrementally, recover after restart,
+and leave existing account data untouched until final commit. Bluesky
+storage keeps the latest observed record at its stable AT URI (not every
+historical revision), and stores media content-addressably within each
+Bluesky local account, with saved records referencing assets rather than
+owning duplicate files. Disabling a save category affects future collection
+only, never deleting previously saved records; local deletion is a separate
+explicit action. Other platforms (X, Facebook) follow their own storage
+models; this ADR is about Bluesky.
diff --git a/docs/adr/0003-match-bluesky-accounts-by-did.md b/docs/adr/0003-match-bluesky-accounts-by-did.md
diff --git a/docs/adr/0004-merge-archive-imports-idempotently.md b/docs/adr/0004-merge-archive-imports-idempotently.md
diff --git a/docs/adr/0005-exclude-credentials-from-archives.md b/docs/adr/0005-exclude-credentials-from-archives.md
diff --git a/docs/adr/0006-offline-first-in-app-browsing.md b/docs/adr/0006-offline-first-in-app-browsing.md
diff --git a/docs/adr/0007-save-complete-media-for-selected-records.md b/docs/adr/0007-save-complete-media-for-selected-records.md
diff --git a/docs/adr/0008-own-the-archive-contract-in-cyd.md b/docs/adr/0008-own-the-archive-contract-in-cyd.md
diff --git a/docs/adr/0009-bound-context-preservation.md b/docs/adr/0009-bound-context-preservation.md
diff --git a/docs/adr/0010-make-each-archive-self-contained.md b/docs/adr/0010-make-each-archive-self-contained.md
diff --git a/docs/adr/0011-ship-v2-archives-without-encryption.md b/docs/adr/0011-ship-v2-archives-without-encryption.md
diff --git a/docs/adr/0012-validate-v2-archive-integrity-before-import.md b/docs/adr/0012-validate-v2-archive-integrity-before-import.md
diff --git a/docs/adr/0013-export-recoverable-incomplete-backups-honestly.md b/docs/adr/0013-export-recoverable-incomplete-backups-honestly.md
diff --git a/docs/adr/0014-use-local-reminders-for-desktop-scheduling.md b/docs/adr/0014-use-local-reminders-for-desktop-scheduling.md
diff --git a/docs/adr/0015-share-contracts-not-runtime-code.md b/docs/adr/0015-share-contracts-not-runtime-code.md
diff --git a/docs/adr/0016-replace-the-unused-desktop-bluesky-model.md b/docs/adr/0016-replace-the-unused-desktop-bluesky-model.md
diff --git a/docs/adr/0017-key-desktop-account-storage-by-uuid.md b/docs/adr/0017-key-desktop-account-storage-by-uuid.md
diff --git a/docs/adr/0018-use-oauth-and-os-protected-credential-storage.md b/docs/adr/0018-use-oauth-and-os-protected-credential-storage.md
diff --git a/docs/adr/0019-store-the-latest-observed-record.md b/docs/adr/0019-store-the-latest-observed-record.md
diff --git a/docs/adr/0020-do-not-use-the-archive-filename-for-validation.md b/docs/adr/0020-do-not-use-the-archive-filename-for-validation.md
diff --git a/docs/adr/0021-use-at-protocol-apis-directly.md b/docs/adr/0021-use-at-protocol-apis-directly.md
diff --git a/docs/adr/0022-run-save-and-delete-as-durable-jobs.md b/docs/adr/0022-run-save-and-delete-as-durable-jobs.md
diff --git a/docs/adr/0023-stage-and-resume-archive-jobs.md b/docs/adr/0023-stage-and-resume-archive-jobs.md
diff --git a/docs/adr/0024-deduplicate-media-within-each-account.md b/docs/adr/0024-deduplicate-media-within-each-account.md
diff --git a/docs/adr/0025-never-treat-save-settings-as-retention-rules.md b/docs/adr/0025-never-treat-save-settings-as-retention-rules.md
diff --git a/docs/adr/0026-export-portable-account-data-not-operational-state.md b/docs/adr/0026-export-portable-account-data-not-operational-state.md
diff --git a/docs/adr/0027-preserve-captured-author-context.md b/docs/adr/0027-preserve-captured-author-context.md
diff --git a/docs/adr/0028-roll-out-archive-readers-before-writers.md b/docs/adr/0028-roll-out-archive-readers-before-writers.md
diff --git a/docs/adr/0029-minimize-bluesky-diagnostics.md b/docs/adr/0029-minimize-bluesky-diagnostics.md
diff --git a/docs/adr/0030-encrypt-credentials-not-saved-content.md b/docs/adr/0030-encrypt-credentials-not-saved-content.md
diff --git a/docs/adr/0031-gate-releases-on-semantic-archive-contract-tests.md b/docs/adr/0031-gate-releases-on-semantic-archive-contract-tests.md
diff --git a/docs/adr/0032-stream-and-defensively-validate-archive-imports.md b/docs/adr/0032-stream-and-defensively-validate-archive-imports.md
diff --git a/docs/adr/0033-persist-credentials-with-disclosure.md b/docs/adr/0033-persist-credentials-with-disclosure.md
diff --git a/docs/adr/0034-derive-bluesky-session-holders-from-account-state.md b/docs/adr/0034-derive-bluesky-session-holders-from-account-state.md