docs(architecture): ADR-004 + ADR-005 (auth dispositions; at-rest key custody)
- ADR-004 (Accepted): publickey-only auth — explicit fails for
none/password/kbd-int/cert (inherited-but-explicit per the one-way-
door pin rationale), offered-hook accept-and-delegate, username
carries no semantics (OQ-03), fingerprint parity invariant,
honest advertisement, max_auth_attempts sized for the counting
none-probe (default 10)
- ADR-005 (Accepted): OpenSSH-PEM inner inside alkvault EncryptedData
(4-way verdict cited), decrypt-at-dial one-time decode, adapter-owned
Zeroizing with the vault-side gap tracked as an upstream ask (OQ-07),
fail-closed failure matrix incl. locked-at-bootstrap, host keys on
the same model, Signer seam dismissed with evidence
- README ADR table updated
glm-5.3-flash
5baebf1e43