Spike native shells and define local-first integrations

docs/decisions/0003-local-data-and-remote-sessions.md

@@ -0,0 +1,25 @@
+# 0003: Data is local; remote sessions live on the user's remote machine
+
+Status: accepted for implementation.
+
+Each Lumbridge installation owns a local SQLite database and content-addressed
+data directory. There is no mandatory Lumbridge account, hosted database, or
+silent multi-device synchronization. Credentials remain in platform credential
+stores, SSH agents, or upstream harnesses rather than SQLite.
+
+Lumbridge supports local work and user-owned remote machines as equal execution
+targets. OpenSSH is the default transport and may reach a Tailscale MagicDNS name
+or tailnet address. An explicit `tailscale ssh` transport is also supported.
+Lumbridge consumes existing connectivity and authorization; it does not manage
+tailnet ACLs or private keys.
+
+Durability belongs where the process runs. A remote per-user Lumbridge runtime
+owns remote PTYs, agents, worktrees, event history, and scrollback. Desktop apps
+connect over a framed SSH stdio stream and reconnect by stable session ID. This
+allows a MacBook to close or change networks without terminating work on metal
+or amd-server.
+
+Another authorized Lumbridge installation may discover and attach to that remote
+workspace. Its device-local window layout and preferences remain local. The
+remote runtime arbitrates a single input owner in the first release; real-time
+collaborative editing is a separate future capability.