Added a staged roadmap to address the issues identified by the code audit

docs/policy/architecture.md

@@ -197,6 +197,7 @@ free of secrets or private transcript data.
 
 - Keep core/domain logic separate from CLI, config, filesystem, reporting, and
   other adapter concerns.
+- Centralize default configuration values as constants defined in internal/config/config.go.
 - Keep modules narrowly scoped, explicitly configured, and composable by
   registry name.
 - Preserve deterministic ordering, final segment ID assignment, and schema

docs/policy/development.md

@@ -52,6 +52,7 @@ Current toolchain note:
 - Keep validation in `internal/config` and package-specific validators.
 - Return errors from deep logic; do not print inside internal packages.
 - Preserve clear package boundaries between adapters and domain transforms.
+- Define configuration defaults as constants in internal/config/config.go.
 
 ## Dependency policy