commit all of this

docs/ARCHITECTURE.md

@@ -53,9 +53,22 @@ This document describes tai's current runtime architecture, module responsibilit
 
 ## Data Stores
 
-- Runbook store (Tier 2): local ChromaDB path, default `~/.tai/runbooks`
+- Runbook store (Tier 2): local ChromaDB path or remote ChromaDB HTTP endpoint (`--runbooks`, `runbooks --store`)
+- Run history store (Tier 3): SQLite file/URL or PostgreSQL DSN (`--history-db`)
 - Session logs: optional JSONL file configured by `--log-file`
 
+External DB auth can be provided by CLI options or dotenv file (`--env-file`) and is resolved without executing downloaded runbook content.
+
+## Runbook Source Ingestion
+
+`tai runbooks sync --path` and `tai runbooks add` support runbook/playbook source retrieval from:
+
+- local filesystem paths
+- SSH URIs (`ssh://...`) via read-only remote fetch (`find`, `cat`)
+- HTTP/HTTPS URLs (single `.md` file or webroot index with `.md` links)
+
+Remote source content is materialized into temporary local files, embedded, and then indexed into the target ChromaDB store.
+
 ## Retrieval Layers
 
 - Tier 1 (implemented): in-memory semantic retrieval over diagnostic chunks