docs: archive workflow plans and introduce constellation

Preserve the accumulated phase-two record and introduce the constellation design and working agreement. Archived approvals and plans are historical, not current authority.

docs/.archive/sharepoint-reference.md

@@ -0,0 +1,65 @@
+# SharePoint reference mirror
+
+Archived: guidance for the existing implementation, not a new design decision.
+
+The Zenith user timer mirrors one selected company SharePoint document library
+into `~/.local/share/yookr-reference/sharepoint` hourly. SharePoint is
+authoritative: remote updates overwrite local files and remote deletions remove
+local files. Never author files there; edit them in SharePoint's web UI. The job
+stops before more than 100 local deletions and reports the failure in the user
+journal. A failed run may leave earlier updates in place and is not evidence of a
+complete current snapshot; rclone does not delete destination files when the run
+has errors.
+
+The timer remains inert until both `~/.config/rclone/rclone.conf` and
+`~/.config/rclone/sharepoint-reference.env` exist and the latter names a source.
+Before adding the SharePoint remote or source file, the user must explicitly
+start the interactive company sign-in and consent step. Use only delegated,
+cloud-read-only scopes:
+`Files.Read Files.Read.All Sites.Read.All offline_access`. Do not accept rclone's
+broader default scopes or create an application registration. Tenant policy may
+require administrator consent or an approved single-tenant application; involve
+the administrator only if the consent response requires it.
+
+After approval, run `rclone config`, choose Microsoft OneDrive, set the advanced
+`access_scopes` value above, and select one company SharePoint document library
+(not a personal account). Before enabling the job, inspect and accept its exact
+scope, footprint, and first change set:
+
+```console
+rclone config redacted company-sharepoint
+rclone lsd company-sharepoint:
+rclone size company-sharepoint:
+rclone sync company-sharepoint: ~/.local/share/yookr-reference/sharepoint --dry-run --max-delete 100
+```
+
+The remote-scoped redacted output confirms the configured requested scopes, not
+what the tenant actually granted. Confirm the consent response also contains only
+the requested read scopes; stop if it denies them or offers broader authority.
+
+Only after that preview is accepted, create the gate with mode `0600`:
+
+```text
+RCLONE_SHAREPOINT_SOURCE=company-sharepoint:
+```
+
+Save it as `~/.config/rclone/sharepoint-reference.env`. Home Manager activation
+then enables the hourly timer. This is the first bounded library, not a permanent
+allowlist or a claim that all accessible SharePoint content is mirrored. Add
+another library only after its own size/preview check, using another native unit
+and dedicated destination rather than widening this source silently. Refresh and
+inspect the current unit with:
+
+```console
+systemctl --user start sharepoint-reference-sync.service
+systemctl --user status sharepoint-reference-sync.service
+journalctl --user -u sharepoint-reference-sync.service
+```
+
+For an accepted deletion set larger than 100 files, rerun the dry-run and then a
+manual `rclone sync` without `--max-delete`; the scheduled guard stays in place.
+The mutable OAuth token remains in rclone's config outside the Nix store. The
+local directory is user-writable and its read-only consumer policy is not an OS
+permission or credential-isolation boundary. New mirror files are private to the
+user by default (`UMask=0077`), but same-user processes can still read and change
+them.