Decision log
Thirty-four architecture decision records, numbered in writing order: twelve accepted on 2026-09-13 (ten with
phase 1, two with the first release), eight accepted on 2026-09-14 for phase 2 (the agentic console), six
accepted on 2026-09-15 for phase 3 (the public site and persona twins) and eight accepted on 2026-09-16 for
phase 4 (workbench roles, the evidence panel, skills, harnesses, memory tiers and inline interaction). Each has the five headings Context,
Decision, Consequences, Alternatives considered and Follow-ups, and an <AdrMeta> block with status, date and
deciders. A record is never edited into a different decision: a new record supersedes it, the old one is marked
Superseded and its body stays. The canonical Markdown lives in decisions/ at the workspace root; these pages
mirror it. A few passages are reworded here because a docs gate rejects the wording: the three that spell the
kit’s internal direction name (0001 Context, 0002 Context and Decision, the 0007 title, check-brand), and
the sentences in 0001 and 0011 Alternatives and in 0021 and 0025 Context that used a word from
words.speedClaims (the timing-word gate), and, since that list grew with phase 4, the 0025 title and the timing-word
phrases in 0025, 0026 and this log; everything else is verbatim.
| ADR | Title | Status | Date |
|---|---|---|---|
| 0001 | Adopt the product-forge method and the reference profile | Accepted | 2026-09-13 |
| 0002 | Single brand, product taxonomy, pillars, stages and prefix rule | Accepted | 2026-09-13 |
| 0003 | Program as the tenant scope and the 72-permission catalog | Accepted | 2026-09-13 |
| 0004 | Assertion kinds and origin on every finding, hypothesis and proposed step | Accepted | 2026-09-13 |
| 0005 | Identity model with a local development identity mode | Accepted | 2026-09-13 |
| 0006 | Enumerations as text columns with named CHECK constraints | Accepted | 2026-09-13 |
| 0007 | Theme tokens from the brand kit, monochrome product accents, 4/8 px geometry | Accepted | 2026-09-13 |
| 0008 | Research-agent action protocol (no git actions) | Accepted | 2026-09-13 |
| 0009 | Documentation structure | Accepted | 2026-09-13 |
| 0010 | Repository layout, local repositories without remotes, release deferred | Accepted | 2026-09-13 |
| 0011 | Git hosting on Bitbucket, project TROV, one repository per surface | Accepted | 2026-09-13 |
| 0012 | Public host names: apex for the site, console for the platform | Accepted | 2026-09-13 |
| 0013 | Console protocol: streaming turns, a stateless tool server and per-role run tokens | Accepted | 2026-09-14 |
| 0014 | ALCOA++ audit envelope, database-computed hashes and an append-only application role | Accepted | 2026-09-14 |
| 0015 | Read-only connectors, agent service identity and ELN content canonicalisation | Accepted | 2026-09-14 |
| 0016 | SOP version binding, QMS authority and impact runs | Accepted | 2026-09-14 |
| 0017 | Pilot scope, light validation package and status transitions | Accepted | 2026-09-14 |
| 0018 | Program-scoped connections with pinned vendor API versions | Accepted | 2026-09-14 |
| 0019 | Model configuration as data with run-start verification | Accepted | 2026-09-14 |
| 0020 | Thread visibility, oversight reads, owner-only sharing and conversation retention | Accepted | 2026-09-14 |
| 0021 | Persona twins: bound agent configurations that propose, never decide | Accepted | 2026-09-15 |
| 0022 | Decisions waiting for you: inbox items, escalation and delegation limits | Accepted | 2026-09-15 |
| 0023 | Hand-offs as records; event triggers from the audit stream | Accepted | 2026-09-15 |
| 0024 | Stage gates: the only writer of the current stage, closed by two signers | Accepted | 2026-09-15 |
| 0025 | Timing is measured, never claimed: event-anchored metrics and baselines | Accepted | 2026-09-15 |
| 0026 | The public site: preview posture, first-party inquiries and cookieless analytics | Accepted | 2026-09-15 |
| 0027 | Workbench roles: a UX and harness layer over the personas, never a permission | Accepted | 2026-09-16 |
| 0028 | cc_by_nc, abstract excerpts and author manuscripts: the rules stand until counsel accepts a change | Accepted | 2026-09-16 |
| 0029 | Licence mapping for new sources, attribution lines, chip classes and the third-party flag on uploads | Accepted | 2026-09-16 |
| 0030 | Skills run on the server as ToolSpecs and worker jobs, recorded in tool_calls, gated by verified references | Accepted | 2026-09-16 |
| 0031 | One master agent, one harness per run, enforced from the run row; lens reviews read-only; no external MCP servers | Accepted | 2026-09-16 |
| 0032 | Release renumbering: 0006 is the workbench migration; stage gates move to R5 as 0008 | Accepted | 2026-09-16 |
| 0033 | Three memory tiers on our own table: promotable kinds, two-party curation, purpose limitation, never training data | Accepted | 2026-09-16 |
| 0034 | Inline interaction: forms in place, docked panels, no popups | Accepted | 2026-09-16 |
The phase-2 records at a glance
| ADR | Decides |
|---|---|
| 0013 | streaming console_turn as a second invocation mode, a stateless tool server in the API, six per-role run tokens with a worker-only key |
| 0014 | the audit envelope, database-computed entry_seq and row_hash, NO ACTION foreign keys, the append-only application role, signatures with a record hash |
| 0015 | read-only connectors, the agent service identity agent:<agent_key>@<org_id>, ELN entry content canonicalisation, one-time launch ids |
| 0016 | SOP versions mirrored from the QMS, explicit and auditable check binding, requirement sets accepted by QA, impact runs |
| 0017 | the pilot positioning “non-GxP decision support with a light validation package”, the light validation package, designed -> preview -> available transitions |
| 0018 | program-scoped connections with a pinned vendor API version and rate budgets as rows |
| 0019 | model configuration as data (MC-n), agent versions gated by evaluation, run-start verification with config_mismatch |
| 0020 | private threads with an oversight read, owner-only sharing, the run-rail rule, conversation retention |
The phase-3 records at a glance
Everything these six records describe is designed; the twins reference pins the
names and counts per release and About personas and twins
explains them.
| ADR | Decides |
|---|---|
| 0021 | a twin as a twin_definitions row bound to one person, persona and program; the allowlist as an intersection with live permissions; standing plans under program.twins.use; file-and-finish detached filing; the bound-user rule; the scientist’s two approve keys leave at persona version 3; no dormant key |
| 0022 | inbox items as transactional pointers; POST /me/inbox/{item_id}/resolve for the bound person and delegates; escalation and names only under program.twins.read; one-hop, 30-day delegation that never routes signatures or stage items |
| 0023 | hand-offs as records created sent on approval; the closed TRIGGERABLE_ACTIONS tuple and the savepoint hook on write_audit; mentions never start a twin |
| 0024 | stage gates as the only writer of current_stage_id; frozen checklists reopened on change; two signatures from different people, the quality one attesting the checklist and not the brief |
| 0025 | event-anchored metrics computed identically for baseline and twin cohorts; baseline before enable; no aggregate from fewer than three programs; the timing-word lint |
| 0026 | the site’s private-preview posture with status words from data; first-party inquiries and aggregate-only analytics through two public API routes; new pages, metadata and security headers |
The phase-4 records at a glance
Everything these eight records describe is designed until the R4 gates pass; the reference pages for
workbench roles, the evidence panel,
skills, harnesses and memory
pin the names and counts.
| ADR | Decides |
|---|---|
| 0027 | fifteen workbench roles as a UX and harness layer over the personas, written in full and never a permission; stored per person and program; five coverage tests; two harness prompts in R4 |
| 0028 | no licence rendering rule changes: no-derivatives stays quote-only, non-commercial, publisher-copyright and unknown stay metadata and link, abstracts follow their own code, author manuscripts stay excluded; three options recorded for counsel |
| 0029 | every new source mapped onto the eight codes; attribution and share-alike lines; the closed chip classes; the third-party flag on uploads with a weekly terms probe |
| 0030 | skills as server-side read tools and worker jobs recorded in tool_calls; a vocabulary layer; a reference gate that refuses unverified guidance constants; fixed honest headers |
| 0031 | one master agent, one harness per run, agent_runs.harness_key as the authority with a harness token claim and harness_denied; lens reviews read-only on request; no external MCP server proxied |
| 0032 | 0006_workbench as the R4 migration (60 -> 63 tables, 189 -> 206 routes); stage gates move to R5 as 0008_stage_gates; the R4 lines of contract 11.4 superseded by 12.7 |
| 0033 | three memory tiers on one table; tier 2 admits three kinds; “Remember this?” before any save; audited, shown, purpose-limited oversight; two-party curation; the no-training statement |
| 0034 | inline forms, docked panels and two-step controls everywhere; modal dialogs, overlays and browser prompts forbidden with the identity re-authentication hop as the single exception; a web lint and a docs rule |
What earns a record
One significant decision: a hosting or identity choice, a data-model rule, a taxonomy change, a navigation
model, a positioning change, or a change to the build method itself (a new gate, a new release rule). Not
a bug fix and not a feature. New records take the next number, are added to _meta.ts in numeric order,
and get a row in this table with the count in the intro bumped.