ADR 0004: Package boundaries

Preserve a portable core and layer crypto, browser, server, framework, database, and testing packages above stable contracts.

Status: accepted for v0.1.

Core contains portable types and validation only. Crypto depends on core. Browser depends on core and crypto. Server depends on core and exposes coordination but no decrypt API. Testing contains replaceable in-memory implementations. Framework and database integrations remain optional packages layered above these contracts.

@ownfold/react is a headless leaf package: it may depend on browser and core contracts but must not render product UI, ship CSS, or introduce presentation dependencies. Host applications own markup, copy, accessibility, styling, and optional representations such as pairing QR codes.