docs(adr): no hand-off and no connector (ADR 0022); several providers and personal keys in ADR 0021

ADR 0022, decided 23 Oct: the hand-off to assistants outside the app and
the Claude connector (ADR 0006) go in v0.19.0, app and server together;
the field keeps the web search. ADR 0021 takes the developer's D4-D6: the
operator's keys for several providers, granted per person; personal keys
on the person's devices, only where the operator allows them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0022-no-hand-off-and-no-connector.md

@@ -0,0 +1,70 @@
+# ADR 0022: No hand-off and no connector
+
+- **Status:** decided 23 Oct 2026, by the developer (D1–D3 below); built for v0.19.0
+  (build 22).
+- **Supersedes:** ADR 0006 (Claude reads studysets through a connector on the instance),
+  and the hand-off to an AI assistant outside the app (decided 10 and 14 Oct 2026, Learn's
+  `AGENTS.md`).
+- **Followed by:** ADR 0021 (an assistant on the instance, on its operator's keys), still
+  proposed.
+
+## Context
+
+Since 10 Oct a question asked from the app could leave it in two ways, both through the
+person's own subscription, as Halkyon called no language model with an API key: the
+hand-off opened the chosen assistant's new conversation (Lumo by default, ChatGPT,
+Claude, …) with the question and the chosen parts written in, for the person to send; and
+Claude's apps read the person's studysets through the instance's connector (ADR 0006: MCP
+at `/mcp` with its own OAuth, connected with a code from Settings › Assistant › Connect
+Claude). Beside them, the same field searched the web.
+
+ADR 0021 proposes an assistant inside the app on an instance whose operator pays for it:
+several providers on the operator's keys, granted per person, with limits and statistics,
+and personal keys where the operator allows them. The developer asked on 23 Oct to "drop
+the Assistant part that just opens the assistant outside of the app, but let's keep the
+web open part", or else decide how the instance's own assistant and opening one's own
+outside the app go together.
+
+## Decisions (23 Oct 2026, the developer's)
+
+- **D1 The hand-off goes now** (over keeping it until the instance's assistant comes,
+  which was recommended): until then the field searches the web only.
+- **D2 The connector goes too** (over keeping it, which was recommended): an instance has
+  one way to an assistant, its operator's (ADR 0021), and nothing else on it reads
+  people's content for a language model.
+- **D3 In v0.19.0, the app and the server together** (over releasing v0.19.0 first and
+  taking the server's part out with the next raise of `minimumAppBuild`, which was
+  recommended): build 22 raises `minimumAppBuild` to 22 anyway, so no app that calls the
+  connector's endpoints can use the instance after it, and nothing needs to stay for
+  older apps.
+
+## What goes, and what stays
+
+1. **In the app:** the assistants a question opened in (`AiAssistant`, `AssistantHandOff`),
+   the switch at the field's start between them and the web (`assistantTarget`), Settings'
+   choice of assistant, Connect Claude with its route, cubit, repository and gateway, and
+   their texts. A device's settings file from before keeps the old keys (`aiAssistant`,
+   `customAssistantUrl`, `assistantTarget`) until the next change of a setting writes it
+   anew without them; nothing reads them.
+2. **On the server:** `lib/src/assistant/` (the MCP endpoint, its OAuth pages and metadata,
+   the five tools, connect codes, tokens), `AssistantEndpoint`, the daily forgetting of
+   the connector's codes and tokens, their lines in Learn's deletion hook,
+   `instance.info().assistantConnectorUrl` (nullable, so an older app reads it as none),
+   and Caddy's forwarding of `/mcp`, `/oauth/*` and `/.well-known/oauth-*`. A migration
+   drops the six tables (`assistant_client`, `assistant_code`, `assistant_connect_code`,
+   `assistant_connection`, `assistant_grant`, `assistant_token`) with every connection,
+   code and token in them: from the deploy on, a connected Claude gets no answer, and
+   people remove the connector in Claude's settings.
+3. **Stays:** the field (`AssistantBar` on Home, `AssistantButton` in the Library, on a
+   studyset and while studying), off unless the person turns it on in Settings, its chips
+   of what the question is about (those a web search takes: a card's front, back, hints
+   and explanation, never a studyset's name or description), and the web search through
+   the engine chosen in Settings, or Android's own search.
+
+## Consequences
+
+- Until an instance offers ADR 0021's assistant, its people ask no language model from the
+  app. learn.halkyon.eu, a public instance, offers none (ADR 0021: public instances leave
+  the assistant unset).
+- The instance reads payloads in one place fewer (ADR 0019's context named four).
+- The privacy page (website repository) drops the connector and the hand-off to Lumo.