Harden control plane boundaries

.pandaos/adrs/0001-git-source-management-boundary.md

@@ -0,0 +1,34 @@
+# ADR 0001: Keep source inventory subordinate to Git-owned build inputs
+
+- Status: Accepted
+- Date: 2026-07-25
+
+## Context
+
+The control plane can inspect and discover repositories, while the deterministic
+builder resolves its site definition and other declared inputs from exact Git
+commits. A mutable source-management UI must not become an alternate build
+configuration channel.
+
+## Decision
+
+Repository discovery and connectivity state remain operational inventory only.
+They may not alter a release input, theme selection, project declaration, or
+source pin. Build inputs continue to come from closed-schema, Git-owned
+configuration resolved into immutable snapshots.
+
+Gitea discovery is fail-closed: its HTTPS origin must be configured and
+allow-listed, its API token comes from the process environment, requests use a
+bounded timeout, and callers are rate-limited. Discovered entries are merged
+atomically into inventory and begin with projection disabled.
+
+Source-management UX may add review and configuration workflows later, but any
+accepted change must be committed to the Git-owned configuration before it can
+affect a release.
+
+## Consequences
+
+- Discovery cannot silently expand release inputs.
+- Operators must configure Gitea credentials and origin policy explicitly.
+- A future writable source UX requires a new ADR describing its Git commit and
+  review workflow.

.pandaos/adrs/0002-remote-publication-not-implemented.md

@@ -0,0 +1,30 @@
+# ADR 0002: Remote publication remains unimplemented and fail-closed
+
+- Status: Accepted
+- Date: 2026-07-25
+
+## Context
+
+The control-plane UI models SSH/rsync targets, but there is no production-ready
+remote deployment implementation. Returning simulated connectivity or success
+would allow operators and reviewers to mistake a UI model for a verified
+publication path.
+
+## Decision
+
+Remote publication and remote connectivity tests return an explicit
+`E_REMOTE_PUBLICATION_NOT_IMPLEMENTED`/HTTP 501 response. The store contains a
+compile-time false capability constant and checks it before reading target or
+build configuration. No configuration field, credential, target state, or
+environment variable can enable shell execution or rsync.
+
+Local staging and activation continue to operate only on checksum-verified,
+immutable release directories.
+
+## Consequences
+
+- The control plane cannot deploy a release to a remote host.
+- Target records remain descriptive UI state only.
+- Implementing SSH/rsync requires a new ADR, an explicit capability boundary,
+  host-key verification, credential isolation, atomic remote promotion, and
+  end-to-end tests.