This directory separates maintained operating guidance from durable decisions
and historical implementation records. Package metadata and the relevant
language's version() function are authoritative for an installed version;
the guides intentionally do not hard-code the current prerelease number.
| Need | Document |
|---|---|
| Understand the current system | Architecture |
| Build the workspace | Building |
| Run local, hosted-browser, and artifact tests | Testing |
| Cut and verify a release | Releasing |
| Diagnose platform failures | Troubleshooting |
| Report a vulnerability | Security policy |
Language-specific installation, API, and migration guidance lives with each package: Rust, Python, and Node.js. The repository overview and browser support matrix live in the root README.
security.md is the engineering record for security corrections, the bundled SQLite inventory, and cryptography-review status. It complements, but does not replace, the vulnerability-reporting policy in SECURITY.md.
The test and release guides describe which checks run on pull requests, which run nightly, and which release proofs fail closed. Workflow files and their pinned tool versions remain authoritative when operating CI.
- Architecture Decision Records define accepted design constraints.
- Report DTO schema defines generated cross-language report data.
- Browser registry is the source of truth for discovery and declared decryption capabilities.
- Platform contract defines build, advertise, test, and publish support.
- Fuzzing guide documents parser targets and local runs.
Generated schemas, public-API snapshots, registry data, package manifests, and workflow definitions take precedence over descriptive prose if they conflict. Treat such a conflict as documentation drift and update the prose or its validator in the same change.
The files under design/ preserve point-in-time reviews and implementation programs. They are useful provenance, not current operating guidance. Dates, versions, line numbers, future-tense steps, and intermediate API shapes in those files describe the recorded baseline unless a maintained guide explicitly adopts them.
Exact prior release versions belong in the changelog, not in maintained guides.