# Technical decisions

This log records the engineering boundaries that are important for reviewers
and future maintainers.

## D001 — Pure analysis core and thin CLI

**Decision:** parsing, policy evaluation, dependency analysis, reporting, SBOM,
and provenance generation remain free of filesystem and network side effects.
Only `cmd/main` collects repository facts and writes output.

**Reason:** deterministic functions are portable across MoonBit backends and
can be tested with small values instead of fragile integration fixtures.

## D002 — Stable finding identifiers

**Decision:** built-in audit findings use `MSxxx`, policy violations use
`MPxxx`, and dependency findings use `MDxxx` identifiers.

**Reason:** CI consumers, SARIF integrations, and policy files need identifiers
that do not change when human-readable guidance is improved.

## D003 — Standards-compatible supply-chain output

**Decision:** SBOM output targets CycloneDX 1.6; static-analysis output targets
SARIF 2.1.0; provenance output uses in-toto Statement v1 with a SLSA Provenance
v1 predicate.

**Reason:** standard formats allow MoonBit projects to integrate with existing
security and compliance systems without custom adapters.

## D004 — No network access in the library

**Decision:** MoonSeal reports declared Mooncakes dependency metadata but does
not query registry or vulnerability services from the core package.

**Reason:** audits remain reproducible and usable in offline builds. Registry
enrichment can be added later behind a separate adapter.

## D005 — Conservative license classification

**Decision:** license text is identified only when stable signature phrases are
present. Unknown text produces a warning instead of a guess.

**Reason:** false confidence is worse than an actionable unknown result. The
tool provides engineering signals and does not replace legal review.

## D006 — Privacy-safe publication archives

**Decision:** competition applications, Word documents, and agent instructions
are excluded from Mooncakes publication archives.

**Reason:** these files are not part of the reusable library and may contain
personal information. `moon package --list` is checked in CI before publishing.