docs: record the five 2026-10-04 decisions in DECISIONS/ (#55)

DECISIONS/2026-10-04-readme-claims-audit.md

@@ -0,0 +1,108 @@
+# Decision: README claims audit
+
+Status:  Decided (eight claim decisions; five pending verification at the machine)
+Date:    2026-10-04
+
+The 2026-10-04 research review flagged README claims a sceptical reviewer
+could disprove. Each was decided one by one.
+
+## Decisions
+
+| # | Claim | Decision |
+|---|-------|----------|
+| 1.1 | Audit log | D — verify at machine |
+| 1.2 | "Production-grade" | D — keep (risk accepted) |
+| 1.3 | DB deployment type | D — verify at machine |
+| 2.1 | Dev password | B — sentinel REPLACE_ME |
+| 2.2 | Machine-specific paths/ports | A — generic defaults |
+| 3.1 | Test count framing | A — break down by tier (verify split) |
+| 3.2 | FastAPI "latest" badge | A — pin and show real version |
+| 3.3 | "ASDEFCON-aware" | A pending verify, with B/C fallbacks |
+
+Option meanings, as presented in the session:
+
+- 1.3 D: match the actual Terraform once verified. Suggested wording:
+  "Dev deploys Postgres as a Container App with external access disabled.
+  Prod uses Azure Database for PostgreSQL Flexible Server with private access."
+- 2.2 A: default to port 5432 with a note for readers running several
+  PostgreSQL instances, and remove machine-specific OS paths.
+- 3.1 A: state scenarios per tier rather than one total.
+- 3.2 A: show the real pinned FastAPI version instead of "latest".
+
+## Detailed records
+
+```
+Claim 1.1 — Audit log claim
+Decision:  D (verify at machine)
+Trigger:   First time back at PostgreDataMigrationAppWithCSVLoader
+Action:    Inspect api/services/ and api/routes/audit.py (or
+           equivalent). Determine if the "every import is
+           registered" claim is true, partial, or false.
+Resolve to: A if false; B if partial; "fix API table description"
+           if true.
+Deadline:  Resolve before next external review of the README
+```
+
+```
+Claim 1.2 — "Production-grade" framing
+Decision:  D (keep as-is)
+Date:      2026-10-04
+Status:    Decided against Claude's recommendation and against
+           the research review's finding
+Risk accepted: Research identified this as the single most
+           damaging line in the README. A sceptical Defence
+           prime reviewer may use it as the signal to discount
+           other claims. Explicitly accepted.
+Review trigger: If any external reviewer flags this line, or
+           if any job interview or presales conversation gets
+           pushed back on it, revisit immediately.
+```
+
+```
+Claim 2.1 — Dev password in README
+Decision:  B (sentinel REPLACE_ME, matching sister project)
+Date:      2026-10-04
+Action:    Replace PGPASSWORD=devpassword123 with PGPASSWORD=REPLACE_ME
+           Add one line: "See .env.example for the configuration
+           template."
+Related:   te-csv-migration PR #13 (2026-10-04) — same pattern
+Future:    If/when pre-flight validator ported to this repo, sentinel
+           will be caught at startup
+```
+
+```
+Claim 3.3 — "ASDEFCON-aware"
+Decision:  A (pending verification), with pre-committed fallbacks
+Date:      2026-10-04
+Trigger:   Next time at PostgreDataMigrationAppWithCSVLoader
+Action:    - Cross-check current VCRM.md output against
+             DID-V&V-DEF-VCRM content requirements (Strategic
+             Materiel V5.x)
+           - Required fields to check: Requirement ID,
+             requirement text, verification method, test
+             reference, result, artifact reference, status
+Resolve to:
+           - A if genuinely aligned: use specific DID reference
+           - B if partially aligned: close the gap first, then
+             use A; or fall back to "VCRM traceability" as interim
+           - C if not aligned at all: drop the ASDEFCON phrase,
+             make it a roadmap item
+Deadline:  Before next external review of the README
+Related:   Research C3 (positioning rigor); this is the
+           single highest-leverage commercial differentiator
+           in the whole README
+```
+
+The session gave claims 1.3, 2.2, 3.1 and 3.2 in the summary form above only.
+
+## Verification results (2026-10-26, `main` @ 59aab1a)
+
+Recorded on #56.
+
+| Claim | Finding | Resolution |
+|---|---|---|
+| 1.1 | True. Every upload and delete writes an `audit_log` row (`api/services/audit.py`), paged by `GET /api/audit/log`. Row counts and timestamps are in the `csv_files` registry. | Fix the API table description |
+| 1.3 | Dev (`infra/terraform`) runs `postgres:16-alpine` as a Container App with `external_enabled = false`. Test, staging and prod run Azure Database for PostgreSQL Flexible Server. | Rewrite to match |
+| 3.1 | Tier P 23, I 1, S 1, E 1, X 1 (X not in CI per ADR-0001) | Use these counts |
+| 3.2 | `fastapi>=0.140.7,<0.142.0` | Badge shows the pinned range |
+| 3.3 | The phrase "ASDEFCON-aware" no longer appears in the README on `main`. DID alignment not checked. | Nothing to edit; alignment check stays open |

DECISIONS/2026-10-04-readme-structure.md

@@ -0,0 +1,19 @@
+# Decision: README structural additions
+
+Status:  Decided
+Date:    2026-10-04
+
+## Decision
+
+Add three sections at the top of the README, as recommended by the
+2026-10-04 research review:
+
+- **Status** — what state the project is actually in
+- **Known Limitations** — gaps stated plainly, so no reader discovers them first
+- **For Reviewers** — where a reviewer should look to check the claims
+
+Add-only: these sections go in without rewriting existing content.
+Claim-level rewrites are governed separately by the README claims audit
+(`2026-10-04-readme-claims-audit.md`).
+
+Applying it is tracked in #58.

DECISIONS/2026-10-04-repo-consolidation.md

@@ -0,0 +1,62 @@
+# Decision: Consolidate PostgreDataMigrationAppWithCSVLoader and te-csv-migration
+
+Status: Decided, direction only. Action deferred to machine access.
+Date:   2026-10-04
+Review: 2026-10-18 (fallback trigger)
+
+## Context
+
+Two public GitHub repos cover overlapping scope:
+
+- amar-python/PostgreDataMigrationAppWithCSVLoader — bash/SQL batch
+  core with FastAPI translator layer, Terraform IaC, 142 SQL
+  assertions, 23 Tier P eval scenarios, VCRM/ASDEFCON design
+  framing. 38 commits.
+- amar-python/te-csv-migration — FastAPI + React rebuild started
+  2026-09-24. 24 passing tests, clean secrets pattern, Lovable
+  frontend decision in progress. ~10 days old.
+
+The research review (2026-10-04) flagged this as a drag:
+  "Two public repos with overlapping scope double the surface a
+   reviewer can find stale."
+
+## Decision
+
+**Path C: merge both into a new canonical repo.**
+
+Reasoning: neither existing repo is clearly ahead; merging forces
+intentional selection of what carries forward and drops accumulated
+debt from both.
+
+## Fallback
+
+If no merge work has begun by **2026-10-18** (two weeks), default to
+**Path A**: PostgreDataMigrationAppWithCSVLoader remains canonical,
+te-csv-migration gets archived with a banner pointing to the sister
+repo. Valuable patterns from te-csv-migration (secrets validator,
+test discipline, clean config module, Lovable frontend adoption)
+get ported manually.
+
+Fallback chosen over Path B because the sister project holds the
+irreplaceable domain depth (SQL assertions, eval scenarios,
+Terraform, ASDEFCON design decisions). te-csv-migration's assets
+are younger and easier to port forward than the reverse.
+
+## Trigger for fallback
+
+"Started" means a new empty repo exists on GitHub with at least
+one commit pulling content from either source repo. Not planning,
+not scoping — a real commit.
+
+## Related
+
+- Research review 2026-10-04 (strategy and blind-spot analysis)
+- te-csv-migration issue #4 (frontend decision, closed with Lovable
+  adoption recommendation)
+
+## Outcome (2026-10-26)
+
+No merge repo existed on GitHub by 2026-10-18. The fallback applied and
+was confirmed by the product owner on 2026-10-26: **Path A**.
+PostgreDataMigrationAppWithCSVLoader is canonical. Archiving
+te-csv-migration and disposing of its open issues is tracked in #72.

DECISIONS/2026-10-04-security-md.md

@@ -0,0 +1,43 @@
+# Decision: SECURITY.md
+
+Status:  Decided
+Date:    2026-10-04
+Review:  2027-01-04 (quarterly audit cycle)
+
+## Scope
+
+Narrow and conventional. Reporting procedure, supported versions,
+response commitment. No architecture/threat-model content —
+that stays out until there's a separate posture doc (not planned
+in current roadmap).
+
+## Reporting channel
+
+Email only. Address TBD at machine. GitHub PVR not enabled.
+
+Mitigation for email-only risk: set the chosen address to
+auto-forward to primary inbox with a filter flagging security
+keywords. Do this when at machine.
+
+## Response commitment
+
+Standard open-source SLA (72hr ack / 7 day triage / 90 day
+disclosure / severity-based fix targets). Phrased as best-effort
+to acknowledge solo-maintainer reality.
+
+Risk accepted: missed SLAs are publicly observable and could
+be used by a reporter to signal broken commitment hygiene.
+Mitigation is the auto-forward above.
+
+## Content choices
+
+- PGP paragraph: kept (offers path, no commitment to maintain)
+- Safe Harbour: kept (standard, low-cost signal)
+- Hall of Thanks: kept
+- Scope section: kept (reduces triage noise)
+
+## Last-audited field
+
+Added. Convention: bump quarterly even if no changes made.
+
+Applying SECURITY.md is tracked in #57 (waits on the contact address).

DECISIONS/2026-10-04-sovereignty-wording.md

@@ -0,0 +1,47 @@
+# Decision: Sovereignty wording
+
+Status:  Decided
+Date:    2026-10-04
+Review:  2026-11-15 (deadline for air-gapped install procedure)
+
+## Framing (effective 2026-11-15)
+
+> Australian-owned, NV2-cleared expertise. Deployable on
+> HCF Certified Strategic cloud or fully offline.
+
+## Interim framing (until 2026-11-15)
+
+> Australian-owned, NV2-cleared expertise. Deployable on
+> HCF Certified Strategic cloud or on-premise, including
+> air-gapped environments.
+
+## Reasoning
+
+Each clause is checkable:
+
+- "Australian-owned" — sole trader, Canberra-based
+- "NV2-cleared expertise" — personal clearance, applies to
+  delivery not software
+- "HCF Certified Strategic" — Microsoft Azure (Australian
+  regions) listed as Certified Strategic at
+  hostingcertification.gov.au
+- "Fully offline" — requires the install procedure below
+
+Avoids the trap of claiming "sovereign cloud" (which a US-
+headquartered hyperscaler cannot deliver) while still
+foregrounding the real sovereignty signal (person, clearance,
+jurisdiction).
+
+## Commitment unlocking "fully offline"
+
+By 2026-11-15, repository must contain:
+
+- docs/offline-install.md with step-by-step procedure
+  (vendored Python wheels, npm cache, container tarballs)
+- One tested dry run on a clean no-internet VM
+- README pointer to the procedure
+
+If not met by 2026-11-15, continue using interim wording and
+re-review deadline.
+
+Tracked in #60.