ADR-0002: Public/private boundary

Context

The handbook touches homelab, auth and backups. Publishing them in detail would expose the attack surface.

Decision

Rule: publish the pattern and the why; keep the exact where and how private. The whole repo is public-curated; the real detail (IPs, hosts, ports, backup destinations, secrets, auth config) lives only in the private vault. A guard (check-leaks) aborts the build if it detects secrets, personal data or personal terms.

Alternatives considered

• Publish everything: unacceptable for security.
• Publish nothing: loses the value of sharing processes.

Consequences

• Public prose is in pattern voice (depersonalized); the guard enforces it.
• Links to private notes do not exist; public repos/sites are linked by URL.