Short records of decisions that are expensive to reverse or easy to undo by accident. Each states the forces, the decision, and what it costs.
An ADR is written when a decision is non-obvious: when a reasonable engineer would pick differently without knowing the context, or when a later change could silently undo it. Decisions that follow from the obvious default do not need one.
| # | Decision | Status |
|---|---|---|
| 0001 | JSON is the permanent wire floor; compact encodings are additive | Accepted |
| 0002 | The binary encoding uses a frozen positional DTO with an extension TLV | Accepted |
| 0003 | Identity is a self-certifying address, not a trust-on-first-use pin | Accepted |
| 0004 | Control frames are signature-gated with two documented exemption classes | Accepted |
| 0005 | A receiver that cannot deliver withholds the acknowledgement | Accepted |
| 0006 | The desync classification gates the re-key, not the acknowledgement | Accepted |
| 0007 | Resends are re-sealed against the current session, never replayed | Accepted |
| 0008 | Rich extras travel inside the MLS plaintext or not at all | Accepted |
| 0009 | Unauthorized membership changes are reported; rejection is opt-in | Accepted |
| 0010 | Leaf identity binding is unconditional and checked at three seams | Accepted |
| 0011 | Relay broadcast defaults on, gated on a capability that guarantees a settled report | Accepted |
| 0012 | The push path assigns one MLS init key per peer | Accepted |
| 0013 | Remote-influenced text is classified to a fixed vocabulary by an exhaustive match | Accepted |
| 0014 | Security-relevant relay answers arrive through dedicated entry points | Accepted |
| 0015 | Relay hint frames are unacknowledged and transport-pinned | Accepted |
| 0016 | Gateways are provisioned, never emergent | Accepted |
| 0017 | Nostr is a carrier, never a gateway | Accepted |
| 0018 | The data layer has two seams: the engine and the backend | Accepted |
| 0019 | Remote document imports are contained, not trusted | Accepted |
| 0020 | Core compiles without std, and std is a default-on feature |
Accepted |
| 0021 | A leaf node speaks MLS, through a second implementation | Accepted |
| 0022 | One sealed layer, shared with the leaf | Accepted |
| 0023 | A control frame states when it was made | Accepted |
Keep them short. Context, decision, consequences, and where relevant an explicit "what would undo this" note, because that is the part a future change needs to see.
Status values: Proposed, Accepted, Superseded by NNNN, Deprecated.