Skip to content

Architecture decision records

ADRs record decisions that constrain public contracts, infrastructure, security, or maintenance. Until the first public release tag, this set is the current decision list: edit or replace a file when the product changes. After that tag, freeze the body and supersede with a new number.

When a public contract, certification tier, or topology rule changes, update the ADR and the human page in the same change. A knowledge note is not a substitute.

Each ADR states context, decision, consequences, alternatives, and provenance.

Current decisions

  • ADR 0001: YAML-only CLI in the user's account. Not a host.
  • ADR 0002: Certified vs experimental. Evidence is authority.
  • ADR 0003: Portable Magento contracts vs per-cloud topology.
  • ADR 0004: Ports and adapters, including day-2 Has* ports.
  • ADR 0005: Artifact manifest lives outside the image. Cosign is Sigstore OIDC.
  • ADR 0006: Local development is generated Compose.
  • ADR 0007: Separate GitHub OIDC roles for CI and state recovery.
  • ADR 0008: In-process Magento; signed go-plugin lock for published adapters.
  • ADR 0009: Dump seed after first deploy. Brownfield attach only where implemented.
  • ADR 0010: No paid multi-cloud CI. Packed live certification with GCP as the thorough path.
  • ADR 0011: Subprocess Dial proof for one adapter (GCP Autopilot); rest stay in-process.
  • ADR 0012: Search proof shapes and AWS spend cap; live runs in Phase 2.
  • ADR 0013: Versioned typed operations protocol; nested provider modules; lockstep alpha.
  • ADR 0014: One fail-closed trust policy for installer, updater, core load, and provider download.
  • ADR 0015: GCP bootstrap prerequisites and an immutable remote Pulumi state passphrase.
  • ADR 0016: Owned GKE node identity and creation-only cluster identity selection.
  • ADR 0017: Cloud SQL primary-zone preference for new instances and safe capacity recovery.