Architecture decision records
ADRs capture durable choices that affect more than one package or phase.
- Filenames use a four-digit sequence followed by a short kebab-case title.
- Status is
Proposed,Accepted,Superseded, orRejected. - Accepted ADRs are immutable except for status and cross-reference corrections.
- A changed decision receives a new ADR that links to and supersedes the old one.
Index
- 0001: Four-layer platform boundary — Accepted
- 0002: pnpm workspace and strict TypeScript — Accepted
- 0003: Development infrastructure — Accepted
- 0004: Replace unmaintained MinIO baseline — Accepted
- 0005: Static module manifests and atomic discovery — Superseded
- 0006: Versioned capabilities and compiled module runtime — Accepted
- 0007: Module-owned Drizzle schemas and table isolation — Accepted
- 0008: Module-owned migration contracts and offline validation — Accepted
- 0009: Transactional module migration execution — Accepted
- 0010: Core identity architecture and Better Auth adoption — Accepted
- 0011: Identity HTTP transport and public enrollment policy — Accepted
- 0012: Production-equivalent identity origin/CSRF protection under test — Accepted
- 0013: Core authorization, permission registry, and platform-owner bootstrap — Accepted
- 0014: Module permission declarations and platform permission registry — Accepted
- 0015: Static module HTTP routing and production runtime lifecycle — Accepted
- 0016: Module database access — Accepted
- 0017: Public request perimeter hardening — client address, signup gating, body limits, timeouts — Accepted
- 0018: Identity session resolution, canonical public origins, and PostgreSQL transport policy — Accepted
- 0019: Durable authorization history and grant management — Accepted
- 0020: Module runtime and migration execution hardening — Accepted
- 0021: Modules as independently hostable products — Accepted
- 0022: Module UI authoring model and host contract — Accepted
- 0023: Module UI build pipeline — Accepted
- 0024: Browser-safe module UI SDK and the generic host loader — Accepted
- 0025: Trusted module UI asset publication — Accepted
- 0026: The minimal Ekklesia module UI host — Accepted
- 0027: Dashboard navigation is presentation configuration, and modules stay flat — Accepted
- 0028: Module operational lifecycle — enablement, eligibility, and what "running" means — Accepted
- 0029: Module configuration is manifest-declared, host-resolved, and secret-free at rest — Accepted
- 0030: Modules declare logical buckets; hosts provide object storage — Accepted
- 0031: Browsers fetch objects directly, through opaque temporary read URLs — Accepted
- 0032: Native module realtime is scoped snapshot state over SSE — Accepted
- 0033: Display UI is a separate, permission-gated module entrypoint — Accepted
- 0034: Dashboard browser authentication is host-owned and principal-first — Accepted