Update planning package after Phase 0B

planning/DECISIONS/004-local-only-production.md

@@ -1,14 +1,14 @@
 # ADR 004 — Local-Only Production Default
 
-**Status:** Accepted
+**Status:** Accepted; Phase 0B hardening requirements identified
 
 ## Decision
 
-The production application will be designed to operate without Internet access.
+The production application will operate without Internet access for ordinary v1 story use.
 
 ## Context
 
-The project requires control over story data, imported material, prompts, and model outputs, with no unintended disclosure to outside services.
+The project requires control over story data, imported material, prompts, model outputs, memories, embeddings, and future generated media, with no unintended disclosure to outside services.
 
 ## Alternatives Considered
 
@@ -18,18 +18,34 @@ The project requires control over story data, imported material, prompts, and mo
 
 ## Reason
 
-Local-only operation best matches the privacy and control requirements.
+Local-only operation best matches the privacy and control requirements. For this project, "local-only" means operation on user-controlled local infrastructure without requiring Internet or cloud services; it does not require every component to run on the same physical machine.
+
+## Phase 0B Evidence
+
+The selected AI-DnD base does **not** satisfy this requirement unchanged:
+
+- `tiktoken` attempted a first-use download of its encoding data,
+- the browser requested Google Fonts at runtime,
+- hosted/cloud/auth/analytics/Postgres/provider paths remain present upstream,
+- inherited endpoint guarding is oriented toward hosted deployment rather than enforcing the project's approved-local-infrastructure model boundary.
+
+These are bounded production-hardening tasks rather than reasons to reject the fork.
 
 ## Consequences
 
-The production application should avoid:
+The production application must avoid or remove:
 
 - telemetry,
 - analytics,
 - cloud inference,
+- hosted authentication/accounts,
 - remote vector stores,
 - automatic web retrieval,
 - runtime CDN dependencies,
-- remote fonts/assets.
+- remote fonts/assets,
+- first-use runtime tokenizer/model-support downloads,
+- arbitrary remote model-provider configuration in normal v1 UI.
 
-All inherited network behavior from a fork must be inventoried during Phase 0.
+Production packaging must contain all runtime assets required for ordinary story use after the user has installed the intended local Ollama models.
+
+The storyteller application should bind to loopback by default. Ollama should default to same-host loopback but may be explicitly configured to an approved trusted-LAN endpoint for v1. This LAN inference path does not authorize LAN exposure of the storyteller UI/API. Arbitrary public/Internet inference endpoints remain prohibited in normal v1 configuration.