Decisions

Every architecture decision this repository has recorded, with what it supersedes, what it put in force, and what has since referred back to it. One page per decision, generated from the decision's own file.

Filtering runs in the browser. Without JavaScript every entry below is still listed, in the order the index resolves them.

Where these come from

117 objects of kind adr, read from the repository's own layer. Nothing on this page is typed into the site: the source class that discovers the files is declared in the repository's knowledge sources, the executable indexes them, and this page, majordomus entity show adr/<slug>, the MCP resource majordomus://adr/<identity> and the Cockpit route /cockpit/objects/adr/<slug> are all projections of that one index.

The references and backlinks each page shows are edges of one graph. A reference is declared in the front matter of the object that makes it; the backlink is that same edge read from the other end, so nothing declares a relationship twice and nothing can declare half of one.

Decisions

A Rust executable with a data-driven, read-only MCP surface over stdio

A canonical capability registry, with MCP, HTTP, OpenAPI, Swagger UI, the CLI and the reference as projections

One shared MCP server per repository, peers, and clients that start it themselves

One canonical declaration, composed modules, derived projections, and performance as evidence

One projection plan over the canonical inputs, named owners for every truth, and the site as a view of the registry

CI planned from one model of what affects what, gates as repository-owned scripts, and the site deployed from the run that verified it

Skills are data under the layer's skills section, and every surface that shows one is a projection

Use cases are executable canonical objects of the layer

Prompt capture happens below the model, or is reported as unavailable

Curated knowledge is one kind with a class, not a second store

Every directory in the layer carries a contract

The Cockpit is a sixth projection of the registry, not an application over it

Every web surface is discovered from its producer, resolved once, and projected

A closed session is a shared object of the layer, not a local note

The episode boundary is drawn by the provider, not by the model

The scenario is a body section, not a header field

An episode that opens is handed what the last one left

Operational moments are objects of the layer, not pages of the site

Distribution is one model, and every surface that ships the tool is a projection of it

The capability graph is composed, not centralised, and projected twice

The branch-to-worktree topology is derived from git identity and enforced everywhere

The UI standard is an audit over a discovered page set, and its failures are fixed at their shared source

Product features are objects of the layer, and the landing page is a projection of them

An orchestrator is a provider only at the bootstrap level, and its worktrees are scratch checkouts

Presentation order is one total order owned by the crate, not a decision each surface makes

A capability module's area is derived from the features that name it, not declared beside it

A command is declared once and every surface is a projection of the command graph

The crate's public surface is measured by the crate, and absence from the API is a decision

The changelog is a projection of what the repository already records, and the version has one writer rather than one source

A task owes obligations, and the evidence that discharges them goes stale

The design is one declaration and every surface is a projection of it

An external workspace is not a provider: the term, the dependency posture, and where synced content lives

An execution is a watched capability call, not a second registry

A checkout's server is one of the repository's, and its state is served like every other fact

The design system is a typed declaration in the crate and every first-party surface consumes its projections

A gate whose runner the repository cannot get on demand is planned on demand, so that the verdict arrives

A scenario declares where it runs, and an obligation is a step

Liveness is four rules, advisory until a scan can decide them

Development semantics are capabilities of one runtime; every surface is a consumer

Proof is a recorded execution, and inputs unchanged is not proven

Entering the repository brings its runtime up, through one bootstrap command the entry file calls

Cooperation is repository-wide because the board is gathered, not because the server is shared

A working context is derived and a closed record is composed; neither is a document somebody must remember to write

The session domain is typed, its identities are not interchangeable, and closing is exactly once

A rule declares how it is enforced, and review is one of the three ways

The model catalogue is declarative data, and routing is an explainable projection of it

Mesh peer discovery is provider-based observation with authenticated node identity

The minimum release version is measured from the public contract, and conventional commits are demoted to evidence

The session lifecycle is the episode's, not the task's

An identity is allocated above the high-water mark, and a collision is refused on the branch

A commit message is a judged value, not a convention and not a prompt

Disk is the fifth self-accumulating quantity — build output is reclaimed by predicate and a build is bounded before it starts

Every object of the layer has a derived address, both directions of every relation, and a declared place of publication

The mesh is on for this repository, and every session start holds it

A gate's verdict is evidence, and a rule the repository enforces itself is proven by it

A verification is proved against a commit, and two attempts that disagree are not proof

A peer's uncommitted work is part of its claim, and a commit that carries it is refused

A declared tool has a version, and a mismatch is a finding

Entry reports a verdict per claim and the evidence behind it, from one preflight value

Mesh cooperation is authenticated links between runtimes and one replicated journal folded the same way everywhere

CI evidence is kept where the run happened, and published with the commit it proves

A capability may be scripted, and repository automation is scripted capabilities rather than shell

An intent is a typed record, and its stage and satisfaction are derived from the plan and the evidence

A feature exists only when its delivery is computed and every dimension passes

An issue names the intent criterion it serves, and the coverage of every criterion is derived from the plan

Which work realises an intent is a join over the records the lifecycle already keeps, and closed work does not outrank evidence

A skill is a capability only when something proves it — tested, documented, enforced and used are derived, never authored

Published content may be written in the reader's language; the repository's own artifacts may not

A CI run reaches the tracked ledger through a recording branch, never through the run that produced it

Token economics are measured from matched runs and published only past a declared rule

The version is authored once, in the crate manifest, and shipped to the shell tool as a generated projection

The crate's rustdoc is a published web surface at /rustdoc, produced by the invocation its gate proves and verified at the public URL

Evidence is indexed by subject and judged at the presented revision

A dashboard is a projection of capabilities, and every card names the answer it was read from

An interface shows only what is derived, and unknown is never drawn as healthy

Knowledge is derived at the episode boundary, from the ledger and git, and a person promotes it

A plan stamp carries the seal of its event, because the ledger never leaves the checkout

Reasoning is provider-independent, advisors are optional, and review is a recorded fact rather than a claim

Pull requests are integrated one at a time, each against a master observed a moment before