docs: fold crash-reporting privacy into README and drop architecture doc

.github/workflows/ci.yml

@@ -144,7 +144,7 @@ jobs:
         uses: ./.github/actions/setup-vp # zizmor: ignore[self-repository]
         with:
           node-version-file: ".node-version"
-          cache: false
+          cache: false # credentialed job: never share a dependency cache with pull requests
 
       - name: Install dependencies
         run: vp install
@@ -265,7 +265,7 @@ jobs:
         uses: ./.github/actions/setup-vp # zizmor: ignore[self-repository]
         with:
           node-version-file: ".node-version"
-          cache: false
+          cache: false # credentialed job: never share a dependency cache with pull requests
 
       - name: Install dependencies
         run: vp install
@@ -345,7 +345,7 @@ jobs:
         uses: ./.github/actions/setup-vp # zizmor: ignore[self-repository]
         with:
           node-version-file: ".node-version"
-          cache: false
+          cache: false # credentialed job: never share a dependency cache with pull requests
 
       - name: Install dependencies
         run: vp install

AGENTS.md

@@ -3,7 +3,7 @@
 ## Repo
 
 - `@putdotio/cli`, the `putio` binary, shipped through npm, Homebrew, and standalone binaries.
-- Code lives in `src/*`; layer rules are in [Architecture](docs/architecture.md).
+- Code lives in `src/*`.
 - `skills/putio-cli` is the consumer skill that ships in the npm package.
 - Contributor setup is in [Contributing](CONTRIBUTING.md).
 
@@ -20,7 +20,7 @@ Run `pnpm exec vp install`, `pnpm exec vp config`, then
 
 ## Development Guidance
 
-- `README.md` is for users, `CONTRIBUTING.md` for contributors, `docs/*` for architecture, `skills/*` for consumer usage.
+- `README.md` is for users, `CONTRIBUTING.md` for contributors, `skills/*` for consumer usage.
 - Keep command modules thin; shared behavior goes in Effect services and layers with `Schema` boundaries and tagged errors.
 - JSON output is the machine contract; terminal output is a separate adapter.
 - When commands, flags, output, auth, `automation`, or `describe.version` change in a way consumers need, update [`README.md`](README.md), [`skills/putio-cli/SKILL.md`](skills/putio-cli/SKILL.md), and its references in the same change.
@@ -41,13 +41,14 @@ does not cover.
 ## Hazards
 
 - The built binary authenticates with `PUTIO_CLI_TOKEN` when it is set, otherwise with the profile in `~/.config/putio/config.json` (or under `XDG_CONFIG_HOME`). `describe` and `whoami` only read; file, transfer, and upload commands change that real account. For isolated state, unset `PUTIO_CLI_TOKEN` and point `PUTIO_CLI_CONFIG_PATH` at a scratch file.
+- README `Crash Reporting` is a public privacy promise. Any change to what a crash event carries or when it is sent updates that section in the same change.
 
 ## Delivery
 
 - Pull requests squash-merge to `main`; every merge must be releasable.
-- The squash commit's type decides the release ([`.releaserc.json`](.releaserc.json)); a release ships npm, binaries, and the Homebrew formula at once ([`ci.yml`](.github/workflows/ci.yml)).
-- [`install.sh`](install.sh) on `main` is the live `curl | sh` installer; a merge changes it at once.
-- Partial release: dispatch `CI` from `main` with the existing tag as `release_tag` ([`ci.yml`](.github/workflows/ci.yml)). Use [`Backfill Release Assets`](.github/workflows/backfill-release-assets.yml) only for releases published before draft-first releases.
+- The squash commit's type decides the release ([`.releaserc.json`](https://github.com/putdotio/putio-cli/blob/main/.releaserc.json)); a release ships npm, binaries, and the Homebrew formula at once ([`ci.yml`](https://github.com/putdotio/putio-cli/blob/main/.github/workflows/ci.yml)).
+- [`install.sh`](https://github.com/putdotio/putio-cli/blob/main/install.sh) on `main` is the live `curl | sh` installer; a merge changes it at once.
+- Partial release: dispatch `CI` from `main` with the existing tag as `release_tag` ([`ci.yml`](https://github.com/putdotio/putio-cli/blob/main/.github/workflows/ci.yml)). Use [`Backfill Release Assets`](https://github.com/putdotio/putio-cli/blob/main/.github/workflows/backfill-release-assets.yml) only for releases published before draft-first releases.
 
 ## Skills
 

CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 ## Setup
 
-Use the Node version in [`.node-version`](./.node-version), then install
+Use the Node version in [`.node-version`](https://github.com/putdotio/putio-cli/blob/main/.node-version), then install
 dependencies and the tracked Git hooks. Pre-push runs the same `verify` gate as
 CI.
 
@@ -44,12 +44,12 @@ Pin `effect` to the version the pinned put.io SDK depends on; `smoke:pack` fails
 if the packed install resolves more than one. The build bundles the SDK, so the
 CLI and SDK share one Effect runtime. If an SDK release needs an Effect API the
 pinned runtime lacks, add a pnpm patch and register it in
-[`pnpm-workspace.yaml`](./pnpm-workspace.yaml).
+[`pnpm-workspace.yaml`](https://github.com/putdotio/putio-cli/blob/main/pnpm-workspace.yaml).
 
 ## Release Setup
 
 Maintainers keep these provider settings in sync with
-[`ci.yml`](.github/workflows/ci.yml); the release fails without them.
+[`ci.yml`](https://github.com/putdotio/putio-cli/blob/main/.github/workflows/ci.yml); the release fails without them.
 
 - GitHub Environment `release`: holds the credentials `ci.yml` reads, no approval, `main` only.
 - `putio-ci` GitHub App: Contents read and write on `putio-cli` and `putdotio/homebrew-tap`.

README.md

@@ -159,14 +159,20 @@ putio telemetry enable
 ```
 
 A report holds a random ID, timestamp, failure category, runtime labels, and the
-release. It never holds the error, credentials, config, arguments, request data,
-paths, or identifiers. The [crash-reporting policy](./docs/architecture.md#crash-reporting-policy)
-has the details. Send deletion requests to the private contact in the
-[put.io security policy](https://github.com/putdotio/.github/blob/main/SECURITY.md).
+release. It never holds the error message or stack, credentials, config,
+command arguments, request data, paths, or device or user identifiers.
+
+- Only unexpected crashes report; ordinary command errors never do.
+- One report per run at most. You still get the local error, and exit waits at
+  most 250 ms for delivery.
+- Builds from source send nothing.
+- If the config file exists but cannot be read or parsed, that run sends nothing.
+- `disable` stops future reports; it does not delete sent ones. Send deletion
+  requests to the private contact in the
+  [put.io security policy](https://github.com/putdotio/.github/blob/main/SECURITY.md).
 
 ## Docs
 
-- [Architecture](./docs/architecture.md)
 - [Contributing](./CONTRIBUTING.md)
 - [Security](https://github.com/putdotio/.github/blob/main/SECURITY.md)
 

scripts/check-architecture.mts

@@ -21,8 +21,7 @@ for (const file of files) {
     violationCount += 1;
     process.stderr.write(
       `${file}:${index + 1}: Effect.run* is forbidden in production modules. ` +
-        "Return the Effect and execute it through NodeRuntime.runMain in src/bin.ts or src/sea.ts. " +
-        "See docs/architecture.md.\n",
+        "Return the Effect and execute it through NodeRuntime.runMain in src/bin.ts or src/sea.ts.\n",
     );
   }
 }