• Decision: Treat keylog and capture as plaintext-equivalent secrets — 0600 files in a 0700 dir under UID 1337, keylog on tmpfs, retention bounded (size + age caps with rotation) and ephemeral by default (teardown wipes /var/log/sidecar; --retain opts in). Never ship secret artifacts to APM.
• Reason: The keylog decrypts all captured TLS; unbounded retention is standing liability and disk-exhaustion risk.
• Trade-off: Artifacts vanish on teardown unless --retain is set.
• Scope: Features 02 and 03.
• Date: 2026-09-09
• Status: active