Decision records
Every significant technical and product decision is an Architecture Decision Record (ADR) in docs/adr/. Numbers are stable; gaps are intentional. The dated decisions log records smaller calls.
| ADR | Decision | Status |
|---|---|---|
| 0001 | The relay is a Rust service on Postgres | accepted (milestone 1) |
| 0002 | Authors sign content, the relay signs nothing and chains it | superseded by ADR 0010 (format v3 signs exact protobuf bytes and a causal link) |
| 0003 | No passwords: an identity key and a key per device, in the Keychain | accepted (milestone 1) |
| 0004 | Offline first with a durable outbox | accepted (milestone 1) |
| 0005 | Typing, status and presence are ephemeral | accepted (milestone 1) |
| 0006 | The demo story only behind a dev flag | accepted (milestone 1) |
| 0007 | Media travels as encrypted, content-addressed blobs | accepted (milestone 4, started during milestone 1) |
| 0008 | FoundationDB is the system of record for logs and sync state | accepted |
| 0009 | Per-Space logs and pub/sub fan-out, not per-device inboxes | accepted |
| 0010 | A versioned protobuf protocol with signed bytes kept verbatim and causal links | implemented (S1) |
| 0011 | Storage behind traits | accepted |
| 0012 | Infrastructure as code (OpenTofu, Kubernetes, GitOps) | accepted (tools chosen by Enzo) |
| 0013 | Hooks as a first-class primitive | accepted, built after M2 |
| 0014 | Memory, files, skills and knowledge are Items in the Space log | accepted, built after hooks (M2) |
| 0015 | Staging runs on Fly.io (gru), with Cloudflare as the edge only | accepted for the staging phase |
| 0016 | Encrypted profiles | accepted (built between S3 and S2) |
| 0017 | Sortable ids (ULIDs) | accepted (S2) |
| 0018 | Persisted Space ownership and transaction fencing | implemented, with production release gates below |
| 0019 | Fan-out bus between relay nodes | accepted (S5) |
| 0020 | Abuse controls | accepted (S6) |
| 0021 | Telemetry without personal data | accepted (S7) |
| 0022 | Measured capacity, and what a billion people would cost | accepted (S8) |
| 0023 | Per-Space sequencing in memory, batched commits to FoundationDB | accepted (S9) |
| 0026 | End-to-end Spaces on OpenMLS, with member-signed checkpoints | accepted (M2) |
| 0027 | End-to-end by default, and privacy only goes up | accepted (M2) |
| 0028 | Agent sandboxes we run ourselves: WASM first, Firecracker microVMs on demand, browsers in microVMs | accepted (M3 design) |
| 0029 | The Zoen web app | accepted (Enzo, 2026-10-09) |
| 0040 | A viewer for every file, an editor for most, and a native WYSIWYG Markdown editor | accepted, being built (research 2026-10-08) |
| 0041 | Live pages: documents that people and agents keep up to date together | proposed (2026-10-08) |
| 0042 | Dynamic UI: native declarative views first, MCP Apps HTML in a sandbox second | proposed (2026-10-08) |
| 0043 | Product metrics without content | accepted |
| 0044 | Experiments, remote config, acquisition source and server-driven onboarding | accepted |
| 0045 | Linking a second device, with its history | accepted (M2) |
| 0046 | Encrypted server backup | accepted as a development implementation |
| 0047 | MLS recovery without a surviving device | development implementation |
| 0048 | Durable agent proposals and approval effects | implemented in the Rust core |
| 0049 | Agent enrollment requires owner device authorization | proposed |