Put the data posture in the documents an operator actually reads

[iderex]

Depends on #14, which states the posture.

A rule that lives only in a decision file protects nobody outside this
repository. The people who need it are operators, who have to answer for their
own deployment, and they will not read a decisions directory.

So it goes where they look: the readme, the notice, the operator instruction, and
the site. In plain words rather than legal ones, and specific enough to be
checkable by the reader.

What it has to say. Adding this address to a server means the server fetches a
file; nothing about the server, its users or their libraries is sent anywhere.
This project keeps no account of who fetched what beyond whatever the hosting
provider keeps on its own, which is named. The plugins listed in the catalogue
have their own data behaviour, which is theirs to describe and not something this
catalogue can promise on behalf of. And personal data stays on the operator's own
host unless the operator deliberately federates it somewhere, which is a thing
they choose and configure, never a default.

The last one is the sentence that matters most and it is the easiest to soften
into meaninglessness during editing. It should stay concrete: name what
federation would mean here, so that a reader can tell whether they have done it.

Done when

The four documents carry the posture in words an operator can act on, the hosting
provider's own logging is named rather than implied, and the boundary between
this catalogue's behaviour and the plugins' behaviour is stated. Reading-
decidable.

[iderex]

Three of the conditions here are met and measurable. One is not, and which list
of documents the done-condition is read against decides whether that matters.

What the documents carry

Both sentences this issue asks for wrap in every file that carries them, so the
count below removes the line breaks first. git grep reads a line at a time and
reports a file that carries such a sentence as one that does not, which is how
the security policy's gap stayed unnoticed until it was counted this way.

for f in README.md NOTICE.md SECURITY.md docs/index.html; do
  u=$(git show origin/main:$f | tr '\n' ' ' | tr -s ' ')
  printf "%-16s provider=%s plugins=%s federation=%s\n" "$f" \
    "$(printf '%s' "$u" | grep -c 'GitHub Pages')" \
    "$(printf '%s' "$u" | grep -c 'separate projects')" \
    "$(printf '%s' "$u" | grep -c 'unless the operator')"
done

README.md        provider=1 plugins=1 federation=1
NOTICE.md        provider=1 plugins=1 federation=1
SECURITY.md      provider=1 plugins=1 federation=1
docs/index.html  provider=1 plugins=1 federation=1

Run 2026-08-16 against origin/main at 65773d0. The security policy's last two
columns were 0 before #113, which is the change that closed them. The three
probes say a sentence on each subject is present; whether it says the right thing
is a reading, and the wording is in the files.

So the hosting provider is named rather than implied in all four, the boundary
between this catalogue's behaviour and the plugins' is stated in all four, and
the sentence about data leaving the operator's host only where the operator
configures it is in all four, with the three concrete forms of it named so a
reader can tell whether they have done it.

What is not met

This issue names four documents: the readme, the notice, the operator instruction
and the site. decisions/data-posture.md names four as well, and they are not the
same four:

git show origin/main:decisions/data-posture.md | grep -n -A 10 'Where this has to be repeated'
49:## Where this has to be repeated
50-
51-The rule is only useful where somebody reads it before making a decision, and the
52-place that happens is the documents an operator opens rather than a file under
53-`decisions/`. These carry it:
54-
55-    README.md
56-    NOTICE.md
57-    SECURITY.md
58-    docs/index.html
59-

It puts the operator instruction outside that list, as the one place still owed
the posture. Against the decision file's four, every condition here is met.
Against the four in this issue, the operator instruction is missing, and it is
missing because it does not exist.

It cannot be written yet either. The instruction would have to print the address
an operator pastes, and that address does not answer:

curl -sS -o /dev/null -w "%{http_code}\n" https://flowfin.dev/manifest.json
404

Run 2026-08-16. install-address-is-answered refuses a tracked file that prints
an install address before it has been read as answering, and the list that leg
reads is empty:

git grep -n 'var Answered' origin/main -- internal/address/address.go
origin/main:internal/address/address.go:54:var Answered = []string{}

The quickstart is #55 and depends on the same thing.

The question left

Whether this closes on the decision file's list of four, with the operator
instruction held by decisions/data-posture.md and by #55, or stays open until
that document exists.

Why this issue closed and reopened on 2026-08-16

The merge of #113 closed it, and nothing about the issue had been met. The body
of that pull request said "It does not close #49", the keyword parser matches
close #49 and does not read the word in front of it, and the same phrase went
into the commit message. I reopened the issue and took the phrase out of the
body. The question at the end of this comment is still open.