Development record

Documents and ledgers never leave the user tier; a public citation requires both gates

adrproposedadr-41

Context

The sources corpus (itd-76) lets an agent consult material the user is not free to name in public. Anything that makes consultation safe rests on two boundaries holding mechanically, regardless of which surface — personal verbs, team share/ingest (itd-126), or paper reconstruction (itd-127) — is doing the moving.

Decision

Documents and influence ledgers never leave the user tier. What crosses into a repo — via share, render, or any future surface — is citation data only. There is no flag, override, or convenience path that commits a corpus document or a ledger file into a repository.
A public citation requires both gates, independently. The source's permission_status grants the right to cite; the ledger line's cited_publicly flag — flipped only by the human — exercises it. Either gate failing blocks the citation, mechanically, at every rendering or sharing surface.

Consequences

Confidential material is protected by construction, not by reviewer vigilance: the share surface refuses confidential: true entries, and a render fails structurally on an unpermitted key.
The rule is enforceable per-surface and testable per-surface; each consuming intent cites this ADR rather than restating the rule, so there is exactly one place to strengthen or amend it.
The boundary covers literal movement and literal strings only. Identifying paraphrase is out of mechanical reach and stays a behavioural rule plus human publish review — stated plainly in itd-76's "What It Cannot Enforce".

Frontmatter

id	adr-41
type	adr
status	proposed
date	2026-08-16

.abcd/development/decisions/adrs/0041-corpus-trust-boundary.md
open on GitHub ↗ · commit history ↗

References5

adr-30Design-record information architecture — flat artefact-type foldersrelated
itd-74abcd Keeps the Names You Ban Out of Everything You Publishrelated
itd-76abcd Lets You Consult Sources You Cannot Cite — and Remembers Every Debtrelated
itd-126A Team Shares One Bibliography Without Sharing Anyone's Corpusrelated
itd-127A Paper Is Reconstructed From the Provenance Ledgerrelated

Referenced by6

adr-43Contributions are inbound = outbound MIT, and the trust boundary is the organisation's role ladderrelated
adr-50Framing traces never enter the record, and automated reviewers never read themrelated
adr-2610141646523373Ingested pages are private by default and reach the project only by a person's promotionrelated
adr-2610142116480836Ideate verdicts are private or public by the person's choice, and an idea's source is named publicly only when it graduatesrelated
adr-2610300908239458Ideate verdicts are private unless the person says publicrelated

mentions10

adr-2610091918443997What may enter abcd's memory notes without the person's yes, and how a note reaches the record
consult-freely-cite-deliberatelyConsult Freely, Cite Deliberately
dcn-26081600000000072026-08-16 — itd-76 planned at the live interview (spc-31 minted, `intent ready` exit 0). The itd-84 hand-run rendered SPLIT, confirmed: itd-76 narrows to the personal core (source add / ledger / sync-banlist / cite-check + guards); team share/ingest files as itd-126 and paper reconstruction as itd-127 (both `refines` itd-76, seeded criteria marked unconfirmed); the trust rule extracts to adr-41 (proposed) + brief invariant 9 — documents and ledgers never leave the user tier, a public citation requires both gates — which the intents cite rather than declare; the stance files as the consult-freely-cite-deliberately principle. Interview rulings: the share surface is the existing `.abcd/development/research/references.csl.json` research store, not a second `.abcd/work/references.json` exchange file (one committed bibliography — resolves the store clash the sources-plan adversarial review flagged); the draft's "Dogfood (already running)" claim was stale and is rewritten as target (no corpus on the development machine); multi-machine ledger ownership explicitly deferred until a second machine exists; persona Maya corrected to Alice. Seven Given-When-Then criteria authored and accepted in full. Rejected: planning the monolith (both remaining open questions gated only the share/ingest part), and holding for itd-77 (the corpus default path works without relocation). Hand-run graded into the decomposition-calibration note.
iss-374The hand-maintained ADR index lists adr-44 as proposed but the record frontmatter is accepted; the index drifted after status was flipped without updating the index
iss-2609252007448074abcd source ledger --flip is the person's act under adr-41 gate 2 (a line is flipped to public citation only by the human), but the shell guard's default hazard registry does not name it, so an agent can run it unprompted; ledger.go refuses a confidential or non-citable source mechanically, so the exposure is misattributed provenance, not leakage. Register the command in the guard's default registry once the guard lane's registry edit has landed.
itd-2610111655362931On the dashboard, the product thinker and facilitator review memory notes and promote the ones worth keeping
itd-2610141646456128A private ideate verdict stays private
spc-31source-provenance-ledger
spc-2610100613109045a-person-who-types-abcd-sees-only-the-commands-people-use
spc-2610111627213138memory-recall