# docs/

Project documentation.

- `decisions/` — Architecture Decision Records (ADRs): the "why" behind the design.
  Numbered from 001; each records context, the decision, and what was ruled out.
- `runbooks/` — step-by-step operational procedures (add a host, add a role, rotate
  secrets).
- `security/` — security baseline, accepted-risk register, per-service checklist +
  template (ADR-002/004).
- `testing/` — testing methodology artifacts + the `VERIFY.md` template (ADR-008/017).
- `access/` — operational-access doctrine + the `ACCESS.md` template (ADR-021).
- `backup/` — backup doctrine + the `BACKUP.md` template (ADR-022).
- `hardware/` — capacity reference + `/capacity-review` output (ADR-012).
- `reviews/` — `/review-repo` audit trail.
- `CAPABILITIES.md` / `ROADMAP.md` / `TODO.md` / `FRICTION.md` — what boma does, the
  build order, the backlog, and recurring-friction notes.

For what is actually **built vs only designed**, see `STATUS.md` at the repo root —
the ADRs describe intent, not necessarily current reality.