ADRs record Architecturally Significant Decisions that are hard to reverse. Format: context → decision → consequences, one file per decision.
| ADR | Title | Status |
|---|---|---|
| 0001 | FastKV registry namespaces are self-authenticating (namespace=signer) | Accepted |
| 0002 | One standard rspack build composition for plugins | Accepted |
| 0003 | every-plugin CLI is the plugin package contract |
Accepted (amended 2026-09-26) |
| 0004 | Dev serve resolves source — no dist fallback | Accepted |
| 0005 | app.ts is the authored descriptor (phase 1 operative) |
Accepted (phase 1) |
| 0007 | Runtime composition is the SSR model | Accepted (amended) |
| 0008 | Manifest composition — host owns the route graph, mounts are gates | Accepted |
| 0009 | Regression stacks run production mode | Accepted (amended) |
| 0010 | Composition contracts kit and precedence | Accepted |
| 0011 | Image-native artifacts — the image is the deployment | Accepted (amended ×3; boot-role narrowed by 0020) |
| 0012 | Ports as scoped resources — one Effect Scope per dev session | Accepted (amended) |
| 0013 | Passkey ceremonies bound to the gateway origin | Accepted |
| 0014 | Single-ceremony passkey sign-up | Accepted |
| 0015 | Platform bundle storage — file transport as oRPC contract concern | Partially superseded; child half reinstated by 0020 |
| 0016 | Unified log pipeline — stream broadcast with levels | Accepted |
| 0017 | Session gas keys primary, relayer fallback | Accepted |
| 0018 | One owner for the session read path (everything-dev/ui/auth singleton) |
Accepted |
| 0019 | Migrations serialize on a journal-scoped Postgres advisory transaction lock | Accepted |
| 0020 | Child bundle storage — R2-backed CDN distribution for all namespaces | Accepted |
| 0021 | Universal runtime image — one image, identity-selected tiers | Accepted |
| 0022 | Two roots — the self-contained app root and the workspace frame | Accepted |
| 0023 | UI bootstrap stubs are generated, not synced | Accepted |
| 0024 | Composition stays manifest-based; route chunks load lazily | Accepted |
| 0025 | Auth identity values derive from the runtime config | Accepted |
| 0026 | pnpm workspace, node runtime — one toolchain for parent and children (v2) | Accepted |
| 0030 | Published source archives — bos:// byte-sourcing for bos import |
Accepted |
| 0031 | Package shape — contract → handlers → services, CLI as presentation | Accepted |
| 0032 | Framework-owned files — inventory, marker, and the upstream-change protocol | Accepted |
| 0033 | The database seam — databaseLayer, and the db/context ownership exit |
Accepted |
| 0034 | The platform release manifest — one pin, everything derived | Accepted |
| 0035 | The deploy console — thin hosting adapter, substrate-independent state | Proposed |
| 0036 | The three pin planes — cross-plane verification as the security model | Proposed |
| 0037 | Sonner is a shared singleton across federation remotes | Accepted |
| 0038 | PGlite-only local databases — no compose, no port fights | Accepted |
| 0039 | Cross-app wallet claim | Accepted |
| 0040 | The registry wire cutover — thin tag + immutable records, slot→remote vocabulary | Accepted |
| 0041 | The approved boot snapshot — restarts never resolve | Accepted |
| 0042 | The composition lockfile — one frozen composition, everything derived | Accepted |
| 0043 | The two-plane boot — the control plane produces, the application runtime consumes | Accepted |
| 0044 | Per-identity PGlite data dirs — concurrent embedded instances corrupt | Accepted |
| 0045 | Per-workspace migration journals — journal identity follows workspace identity | Accepted |
| 0046 | Manifest attribution — the deploy train signs version manifests; the key record lives in the on-chain config | Accepted |
| 0047 | One committed artifact — bos.lock.json absorbs the sync baseline; everything under .bos/ is local-only |
Accepted |
Skipped numbers: 0006 exists; there are no gaps otherwise. 0015–0018 were renumbered from duplicate 0007/0011/0012/0013 numbers on 2026-09-26 — the original numbers were accidentally reused by dev-session efforts; the low-reference file in each pair moved (see git history). 0029 (agent surface split) was added on a side branch that never merged to main — do not reuse it.
- Take the next free number (
ls docs/adr/ | sort -n | tail -1, then +1 — next free is 0047). Never reuse a number, even for a rejected ADR. - When citing an ADR in code, plans, changesets, or AGENTS.md, cite the number with the filename if the context could be ambiguous.
- Superseded ADRs stay in place with a
Superseded bystatus link to the replacement — they are history, not garbage. - Amendments append a dated
## Amendmentsection and update the Status line.