Refresh distributor documentation

docs/policy/architecture.md

@@ -13,6 +13,12 @@ Generated reports must be associated with explicit metadata, including report ty
 
 `scriptorium` is an external adapter, not domain logic. Subprocess execution must be isolated under `internal/adapters/scriptorium`, use context-aware execution, avoid shell interpolation, capture actionable stderr, and keep scriptorium-specific flags from leaking into domain packages.
 
+`distributor` is also an external adapter. Upload behavior must be isolated
+under `internal/adapters/distributor`, dependency types from the distributor
+module must not leak outside that adapter, and the selected upload source must
+be the managed Markdown report rather than optional output copies or broad
+workspace scans.
+
 ## Project Shape
 
 Default to a small, explicit, dependency-light Go application. Keep the design modular enough to test and change safely, but do not add abstraction unless it protects a real boundary or enables a real extension point.
@@ -54,7 +60,7 @@ Configuration precedence is:
 
 Prefer YAML configuration unless the project has a strong reason to use another format. Config files should be discovered at `/usr/local/etc/<app_name>/config.yml`, with a CLI override via `--config`.
 
-Configuration files should not contain raw secrets unless the application is explicitly designed for that. Prefer environment variables or secret files for secrets.
+Configuration files should not contain raw secrets unless the application is explicitly designed for that. Prefer environment variables or secret files for secrets. File-backed secrets are loaded through `secrets.directory`; secret values must not be logged, persisted, or included in user-facing output.
 
 ## Adapters and External Integrations