docs: accept ADR 0048, one generic image with installed modules outside it

Ekklesia produces one platform image with zero feature modules. Installed modules live in installation-owned storage selected by EKKLESIA_MODULES_DIR (/var/lib/ekklesia/modules in the image, <repo>/modules in development), mounted read-only and discovered only at a controlled restart. An installed module directory is self-contained; the platform lends it no dependencies. Uninstall is distinct from disable and purge: removing module code keeps its data and stored state, and applied migration history of an absent module is retained and reported instead of blocking planning. Present modules and Core stay strictly validated. Supersedes in part ADR 0044 (composition from pinned sources) and ADR 0009 (rejection of history absent from the inventory); amends ADR 0006; extends ADR 0028 and ADR 0030. ADR 0047 gains a cross-reference saying it must be revised before acceptance, and deploy/README.md notes that its composition model is being replaced. No code, Dockerfile, Compose, CI, or test changes. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-07 07:45:21 -05:00
parent fc504eee0a
commit cefdde36a2
4 changed files with 322 additions and 0 deletions
@@ -13,6 +13,10 @@
  [ADR 0043](0043-display-offline-code-fallback.md),
  [ADR 0044](0044-self-hosted-reference-deployment.md),
  [ADR 0045](0045-split-dashboard-and-api-origins.md)
+- Must be revised against: [ADR 0048](0048-generic-image-and-installed-module-storage.md) —
+  steps 1 and 3 below build the module into a deployment image, which ADR 0048 rules out. Before
+  this proposal is accepted, the harness must run the module from module storage in the generic
+  image.

 ## Context