Documentation architecture decision

Status: implemented local architecture decision; production certification remains separate.

The supplied DOC-021 plan described an Astro/Vercel host. The current application is a TanStack Start React application emitted as a Cloudflare Worker; the independent marketing site uses Astro. Embedding the REST reference in the application uses the official @scalar/api-reference-react@0.9.66, pinned in package.json/package-lock.json, not the Astro package and not a CDN. This is the explicit implementation substitution for the obsolete host assumption, not a claim that an Astro/Vercel spike was performed.

The reference fetches the canonical same-origin OpenAPI3.1.1 document without cookies, bundles Scalar and styles, disables telemetry/persistAuth/default remote fonts/agents, and uses the public auth boundary. Standards validation uses pinned @scalar/openapi-validator@0.1.2 plus JSON Schema2020-12 example validation. Local emitted-Worker browser receipts exercise actual hydration, key entry/storage/network privacy, accessibility and recovery.

Production scripts are restricted to self plus a response nonce, with no unsafe-eval or unsafe-inline script permission. Zod is configured jitless before Scalar schema construction because even a caught eval probe violates CSP.

The style-src unsafe-inline exception is deliberately retained: Scalar and the application emit dynamic style attributes/style rules for component layout, theming and overlay positioning. Script execution remains nonce-restricted; styles cannot authorize external requests because connect/font/img policies remain constrained. The exception must be re-reviewed when upgrading Scalar, removing it when the upstream styling mechanism supports the nonce without breaking controls. This note records the engineering rationale, not a substitute for independent security review or production evidence.

No unreviewed third-party proxy or telemetry destination is approved. Same-origin /api/v1 makes deployment infrastructure changes independent from documented URLs. Public support and private security-reporting contacts are published in API support. Deployed conformance must still be verified before changing the draft stability/readiness language.