ARCH-001 — Establish secure-commerce architecture and an atomic execution backlog

[daliu]

Problem

The repository lacked one authoritative system design, Stripe/race/merchandise integrity model, dated security risk register, operations runbook, launch gates, and one-agent issue decomposition. Historical docs also presented stale deployment and waiver assumptions as current.

Outcome

Publish a root documentation set that clearly separates assessment baseline, working-tree remediation, target architecture, residual launch blockers, operator procedures, and atomic issue ownership.

Scope

• Root README, SYSTEM_DESIGN.md, STRIPE_COMMERCE_DESIGN.md, SECURITY.md, OPERATIONS_RUNBOOK.md, IMPLEMENTATION_PLAN.md
• GITHUB_ISSUES.md, GITHUB_ISSUE_SLICES.md, and repository AGENTS.md
• Safe environment-name examples and ignore rules
• Historical banners/corrections under docs/
• No cloud/provider configuration, deployment, or legal approval

Acceptance criteria

• Current and target architecture, trust boundaries, invariants, data/state models, and failure recovery are documented.
• Live commerce is explicitly blocked until every P0 gate has code, tests, configuration, monitoring, owner, and staging evidence.
• Parent trackers and one-agent children include dependencies, proof, and stop conditions.
• Inventory semantics, payment/webhook behavior, privacy/security risks, and operational drills are unambiguous.
• Historical docs cannot be mistaken for current security or waiver instructions.
• Relative Markdown links and diagnostic build pass.

Dependencies

None. This issue publishes the coordination source; implementation children remain independently claimable and closable.

Coordination

A verified local working-tree implementation predates publication of this issue. This issue records the exact ownership boundary before any further editing or PR work. The existing diff must be isolated onto the claimed branch before review; unrelated changes and the pre-existing public/sitemap.xml modification are excluded.

Do not edit the listed paths or duplicate this outcome while the issue is assigned and has a valid timestamped CLAIMED marker.

[daliu]

CLAIMED by Codex agent /root at 2026-07-12T20:50:26Z; branch codex/issue-104-secure-commerce-docs.

Existing shared working-tree implementation predates issue publication. I will isolate this outcome onto the named branch serially before opening a PR; no unrelated dirty path is included.

[daliu]

User-directed documentation addendum (2026-07-12):

Expand this claimed documentation outcome with an officer-continuity layer for a nontechnical backup maintainer:

• root OFFICER_START_HERE.md: one-screen entry point and reusable one-line AI request
• root OFFICER_HANDBOOK.md: short, numbered procedures with page/data/deployment diagrams, proof/rollback steps, access continuity, and stop conditions
• README.md: officer-first link before engineering material
• AGENTS.md: permanent plain-language documentation contract for every future issue
• docs/CONTENT_GUIDE.md: route officers to the new handbook and remove any implication that code edits or a green workflow prove a live update
• basic Google Doc entry point for officer sharing; no secrets, private links, personal data, or provider configuration

Documentation must clearly separate: code changed, code merged, frontend live, Firebase/backend live, and external provider configuration verified. The current Netlify/GitHub Pages split and Firebase deploy skip remain explicit warnings.

No production, DNS, provider, legal, payment, or data mutation is included.