docs(adr): record the three decisions the lab buildout rests on

[Gerrrt]

What changed

Three new ADRs, plus two count corrections in the README that the previous pass
missed. Nothing about the running lab changes.

ADR	Decision
0006	Network detection goes on morpheus, not on the hypervisor
0007	Saruman is the defended estate; ifrit is the offensive range
0008	Services are placed by the trust of their data, across two hosts

Why

Each of these turned on a judgment worth recording rather than a fact worth
looking up — which is what docs/adr/0001 says an ADR is for.

0006 — detect at the chokepoint. A sensor on the hypervisor sees VLAN 30,
which is to say it sees the hypervisor. The segment that warrants inspection is
Skids, with seven cameras and a Tuya device on it. Mirroring the trunk into the
lab would fix the visibility and damage the trust boundary at the same time, so
Suricata goes on the firewall instead. The unconfigured pfSense-pkg-snort is
removed. Honest costs recorded: more load on the single point of failure, and a
FreeBSD package rather than a digest-pinned container.

0007 — the lab splits in two. Sharing one box between attack tooling and the
target estate confounds "my detection fired" with "my own tooling made that
noise." Lab telemetry stays on VLAN 30 behind its own stack rather than
remote-writing into management, because security.md names a lab VM reaching the
house as a threat this design defends against. Costs a second observability stack
and a machine not yet bought. ifrit's isolation mechanism is left open
deliberately rather than assumed — adding a segment is a decision this project
has already declined once.

0008 — services by data trust. A password vault and a film library aren't the
same kind of thing, so they don't get the same segment. The sensitive tier lands
on Winterfell under the 50→99 rule that already exists; the media tier lands with
the televisions it serves, which answers the terminal-VLAN problem by placement
rather than by exception. No new segment — the seven VLANs stand and ADR-0002
needs no amendment.

That last one carries a real cost and says so at length rather than burying it:
putting Immich on Winterfell dilutes the boundary ADR-0002 calls total, and that
is the strongest argument for the dedicated segment this ADR rejects. The
mitigations are stated, and so is what would change the decision. Single sign-on
is deferred on the strength of two users, no remote access, which leaves the
"no MFA on internal services" gap in security.md open knowingly.

Also fixes two README counts the last pass missed: three inter-VLAN rules rather
than two, and eight ADRs rather than five.

Blast radius

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Documentation only. These ADRs describe rules 50→40 and 99→20 as decided, but
neither exists yet and neither is created here — they land with the hardware.

Verification

• make validate passes — all checks passed
• Deployed to the lab and confirmed working — n/a, documentation only
• Docs updated (docs/, service README, or docs/roadmap.md)

Form follows docs/adr/0003 and 0004: Nygard structure, numbered options in
Context, Consequences carrying the honest downsides rather than only the wins.

---

Generated by Claude Code