Publish the design documents as docs/design/

[Jason-Vaughan]

What

Publishes eight design documents as docs/design/, linked from README.md and CONTRIBUTING.md:

Document	Canonical for
architecture.md	Process topology — what runs separately, what breaks between them
api-contract.md	The four surfaces (HTTP, MCP, CLI, GUI) and what each promises
data-model.md	Every entity, where it lives, what survives a crash
security-model.md	What is protected, from whom, what each control buys
boundaries.md	Contract surfaces you cannot quietly change
observability.md	The one signal, and what it cannot answer
nonfunctional-requirements.md	Performance, reliability, cost, compatibility targets
operations.md	Install, configure, diagnose, recover, release

CONTRIBUTING.md gains a parity line: changes to routing, adapters, or either HTTP surface should
update the matching document in the same PR.

Why

This reasoning existed but was kept local, so the repo showed what the router does and never why
it is shaped that way. That is exactly the material someone needs to evaluate whether to depend on
TangleBrain, or to find somewhere to start contributing.

The documents keep their candor. They name the project's weaknesses plainly — that the bind
address is the entire access control story, that budget_usd_month is a declaration rather than an
enforcement, that no test guards the loopback bind. Every gap they name now has a tracking issue, so
each admission arrives with a fix path instead of standing as an unactionable weakness:

• [chore] Add a test asserting both servers bind loopback-only #98 — no test asserts the loopback bind (good first issue)
• [feature] Warn when a key_ref file is group- or world-readable #99 — key_ref file permissions unchecked (good first issue)
• [feature] Record failed tasks and lost failover attempts in the usage log #100 — failed tasks and lost failover attempts go unrecorded
• [chore] Decide the lifecycle of usage.jsonl: unbounded growth + cache-tier placement #101 — usage.jsonl growth and cache-tier placement
• [bug] --roster help text misstates the default roster path #102 — --roster help text misstates the default (good first issue)
• [chore] Unbounded core dependency constraints + no scheduled CI to catch upstream breaks #92 — unbounded core dependencies, no scheduled CI

Filed alongside them, from designing a multi-backend coordination setup:

• [feature] Designated orchestrator: declare a coordinator instead of round-robin rotation #95 — no way to designate a coordinator instead of round-robin
• [bug] --model on a can_orchestrate entry silently strips the delegate tool #96 — --model silently strips an orchestrator's delegate tool (good first issue)
• [feature] Capability-routed delegation can only route down — no quality floor #97 — capability routing can only route down, never up

Test plan

• make test — 495 tests, green (17 skipped, the opt-in live suite).
• No production code changed; this is documentation plus two doc-link edits.
• Verified every relative link in docs/design/ resolves to an existing file.
• Swept the curated text for machine paths, personal identifiers, cross-project references, and
  credential-shaped strings — clean.