{
  "version": "3.0.0",
  "updated_at": "2026-10-09T22:30",
  "decisions": [
    {
      "id": "0001",
      "title": "sops-пути — только через config.sops.secrets.<name>.path",
      "status": "accepted",
      "date": "2026-10-09",
      "file": ".agent/decisions/0001-sops-secrets-paths.md",
      "tags": ["sops", "secrets", "security", "invariant"]
    },
    {
      "id": "0002",
      "title": "Backups — external to Nix repo, awaiting 5.6 answer",
      "status": "draft",
      "date": "2026-10-09",
      "file": ".agent/decisions/0002-backups-external.md",
      "tags": ["backups", "documentation", "T5"],
      "task": "T5",
      "blocked_by": [
        "user: open question 5.6 (where are backups, how are they verified)"
      ]
    }
  ],
  "proposals": [
    {
      "id": "T3-A",
      "title": "nftables fix для otreca (R1.6: явная policy drop, убрать firewall/nftables конфликт, SSH только на tailscale0)",
      "status": "accepted",
      "date": "2026-10-10",
      "files": [
        ".agent/decisions/proposals/vds-nftables-fix.md",
        "configurations/vds.nix"
      ],
      "tags": ["nftables", "vds", "otrecа", "security", "R1.6", "T3"],
      "task": "T3",
      "notes": "Applied 2026-10-10 via nixos-rebuild switch on otreca. Verified live: nft list ruleset = policy drop + 5 accepts, iptables empty, SSH via Tailscale works, Xray REALITY on 443 listening."
    }
  ]
}