wiki/decisions/2026-06-30-detect-search-vendored.md
ADR: detect-search vendored into arijit-skills and runs on the VPS
Date: 2026-06-30 Status: Accepted (verified live)
Context
detect-search is PRISM's keyless tech and search-vendor detector (Playwright network-packet
inspection). It lived as a standalone, unversioned directory under ~/.claude/skills/detect-search,
and it was not yet runnable on the VPS executor. The audit tech-stack module depends on it.
Decision
Vendor detect-search into the arijit-skills repo at skills/detect-search/ and symlink
~/.claude/skills/detect-search into the repo (matching the algolia-* skills pattern). Install its
deps on the VPS so it runs there.
Rationale
One source of truth, edit then commit, no drift. The symlink keeps the working path while the repo holds the canonical copy. Vendoring also makes the "all of it is on GitHub" claim true for the tech detector, not just the audit skills.
Alternatives Considered
| Option | Why rejected |
|---|---|
| git-init detect-search as its own repo | A second repo to maintain; folding into arijit-skills keeps one |
| Leave it standalone and unversioned | The status quo we are fixing; drift risk, not on GitHub |
Consequences
- Committed to arijit-skills, pushed to main.
node_modulesand the runtime workspace are gitignored. Backup of the old mac dir kept. - Verified live on the VPS:
detect-search.js --full-techagainst petsmart.com detected Algolia (real endpoint, index, instantsearch agent), 14 categories, no bot block. - This unblocks the audit tech-stack module on the executor. See detect-search.