Decisions

2026-08-16 Added a Specification version lock-step step to ci.yml (slice S049), running cargo xtask spec. It asserts the specification's Applies-To field equals the workspace version and that every changelog.d fragment carries a valid spec-impact line, making constitution principle P-11 enforceable in continuous integration.

2026-08-16 Extended the release-preparation scripts (scripts/cut-release.sh and scripts/New-Release.ps1, slice S049) to move the specification's Applies-To field to the new version alongside the workspace bump. The field is bound to the workspace version by the new cargo xtask spec check that runs in cargo xtask ci during release preparation, so without this the check would fail on the stale field on every release.

2026-08-16 Renamed the shipped seed store from hint.db to catalog.db in .github/workflows/release.yml (slice S050): the release now builds, stages, archives, and checksums catalog.db beside the binary, which the first-run bootstrap copies into the per-user catalog store. The MSI (wix/main.wxs) installs the same file under the new name.

2026-08-17: The release workflow (.github/workflows/release.yml) now seeds the detection signature table into the shipped catalog.db. Before slice S053 the release built a barebones catalog by importing the committed empty hint seed, which under the S053 schema (version 5) creates an empty signature table; the shipped catalog would then detect no engine, anti-cheat, or DRM until an operator ran targets seed-signatures by hand. The build step now runs fragcap targets seed-signatures --db target/release/catalog.db immediately after the import, so the archive and the MSI both ship a catalog whose detection works out of the box. The seed is offline (from the bundled Appendix B document embedded in the binary) and idempotent, so it adds no network dependency and re-running is safe. This is a dated decision recorded per the pinned-artifact rule (constitution: workflows change only with a changelog.d/*.decisions.md fragment).

2026-08-18 npcap license determination for the doctor --fix fetch action (slice S056, issue #143). The npcap LICENSE (https://github.com/nmap/npcap/blob/master/LICENSE) grants free use (install and use five copies, unlimited when used only with Nmap, Wireshark, or Microsoft Defender for Identity) and prohibits redistribution and transfer of the Software Product ("not open source software and may not be redistributed or used in other software without special permission"; a licensee "may not ... redistribute, encumber, sell, rent, lease, sublicense, or otherwise transfer" it). No clause restricts a user, or a tool acting on the user's machine, from downloading the vendor's official installer and running it. Determination: fragcap fetching the vendor's own signed installer from the official location and launching it, while embedding, copying, hosting, or caching nothing in any fragcap artifact, does not redistribute npcap and is permitted. Guardrails carried into the implementation: fetch only from the vendor's official location, store nothing as fragcap's own, and act only under an explicit interactive confirmation.

2026-08-18 Constitution amendment authorized by the operator (slice S056): Licensing rule 2 changed from an absolute ("It never downloads, installs, or invokes an installer") to a narrow, user-confirmed carve-out permitting fragcap to fetch and launch the vendor's own signed installer under an explicit interactive confirmation (as in doctor --fix), storing nothing in any fragcap artifact and redistributing nothing. Rules 1 (no bundling), 3 (documented prerequisite), and 4 (no SDK vendoring) stay absolute; P-1 and P-9 are untouched. Constitution version 1.2.0 -> 1.3.0 (MINOR: an existing section materially expanded). Recorded here per the amendment policy; the reasoning is in the constitution's Sync Impact Report.

2026-08-18 http_req added as an optional dependency of fragcap-cli behind the net feature, for the npcap installer fetch. It is already in the workspace graph via fragcap-targets, so this adds no package to Cargo.lock; the net feature is off by default, so the shipped end-user build never compiles it, and cargo xtask msrv (default features) never sees it.

2026-08-18 Corrected the golden-regeneration step in the release-preparation scripts (scripts/cut-release.sh and scripts/New-Release.ps1). Both named a fragcap-cli test binary cli_run, which the S054 command-line surface rework removed when it collapsed run, tap, and watch into capture. The goldens that carry the embedded fragcap/<version> string moved with it: cli_capture now owns capture.fcapng and capture.jsonl, and cli_extcap owns run.fcapng. Preparing v0.5.0 failed at that step with no test target named cli_run, after the version bump had already been committed, leaving a half-prepared release branch. Both scripts now regenerate through the three binaries that actually own the version-bearing goldens, and the comment above the step names which golden belongs to which binary so the next rename is caught by reading rather than by a failed release. Recorded as a dated decision per the pinned-artifact rule (scripts/** changes only with one).

2026-08-18 Corrected the catalog-seeding step in the release workflow (.github/workflows/release.yml). It called fragcap targets import and fragcap targets seed-signatures, both of which the S054 command-line surface rework moved into the new catalog namespace that owns every write to the shipped, disposable store. On the v0.5.0 tag the step failed with invalid target value: import must be a JSON array of targets (the user-store importer rejecting a catalog seed document) and unrecognized subcommand 'seed-signatures', ending the run before the MSI, the archive, or the release were built. The two calls now name catalog import and catalog seed-signatures, verified locally against the committed assets/hint-seed.json: the import creates the store and the seed loads 23 detection signatures into it. A stale targets seed-signatures reference in the fragcap-cli help text is corrected in the same change. Recorded as a dated decision per the pinned-artifact rule (.github/workflows/** changes only with one).