Skip to content
LQMS
Architecture Decision Records
Initializing search
nburri/lqms
LQMS
nburri/lqms
Home
Evaluate LQMS
Evaluate LQMS
LQMS Known Limits
LQMS Security Posture
Architecture
Architecture
1. Introduction and Goals
2. Architecture Constraints
3. Context and Scope
4. Solution Strategy
5. Building Block View
6. Runtime View
7. Deployment View
8. Crosscutting Concepts
9. Architecture Decisions
10. Quality Requirements
11. Risks and Technical Debt
12. Glossary
The arrival bundle format
Decisions (ADRs)
Decisions (ADRs)
ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth
ADR-0002: Single Instance with Scope Hierarchy and Copy-on-Derive
ADR-0003: Fixed Life Cycle States with Configurable Review Processes
ADR-0004: Global Catalogs for Roles and Document Types with Per-Scope Activation
ADR-0005: Modular Monolith
ADR-0006: Three-Layer Search with In-Database Index and Pluggable LLM
ADR-0007: Angular Frontend with Server-Side-Only Enforcement
ADR-0008: Flyway Migrations and jOOQ Codegen from the Migrated Schema
ADR-0009: RLS Enforcement via a Session-Scoped Authorized Scope Set
ADR-0010: Self-Managed QMS via an Internal Mandator
ADR-0011: Authentication via OIDC SSO with Server-Side (BFF) Sessions
ADR-0012: Permission-Based Authorization and System Bootstrap
ADR-0013: User Identity Lifecycle
ADR-0014: Electronic Signatures (Part 11 / Annex 11-Capable)
ADR-0015: Document Effectivity, Periodic Review & Validity
ADR-0016: Data Retention, Disposal & Privacy (FADP / GDPR)
ADR-0017: Multi-Part Version Content
ADR-0018: Non-Functional Targets (Capacity, Availability, Security)
ADR-0019: Notifications & Tasks
ADR-0020: Internationalization (Content Language, Time Zones, Formatting)
ADR-0021: General Typed Document Relationships
ADR-0022: Read-Acknowledgement & Questionnaires
ADR-0023: Migration / Import — Current Released State
ADR-0024: Draft / In-Review Cancellation
ADR-0025: Disposal & Erasure Mechanics (Storage, Index, Backups)
ADR-0026: RLS Runtime Safety — Connection-Pool Scope Isolation
ADR-0027: RLS Boundary — Content-Plane vs Control-Plane
ADR-0028: Stateless Encrypted Token-State Cookie (no server-side session store)
ADR-0029: Document Content Model — Draft-Freeze, Content-Table RLS, Append-Only Audit
ADR-0030: Review & Life-Cycle Realization Model
ADR-0031: Released-base readability enforcement & copy-on-derive mechanics
ADR-0032: Frontend realization — Quinoa, Angular Material, i18n & E2E
ADR-0033: CSRF control for the BFF session — SameSite + JSON content-type
ADR-0034: Notification realization — in-process domain events + system-context fan-out
ADR-0035: Fan-out contract as shipped — gate semantics, count disclosure, audit protocol
ADR-0036: Repository layer — services carry rules, repositories carry jOOQ
ADR-0037: Task scheduler — in-process tick, advisory-lock election, SQL sweep
ADR-0038: Periodic-review realization — derived due date, policy-gated confirmation
ADR-0039: Sweep & periodic-review contract as shipped — grants, guards, addressing
ADR-0040: Disposal-due surfacing — closure-anchored retention, scope-level legal hold
ADR-0041: Email channel & notification i18n — notification-as-outbox, structured messages
ADR-0042: Disposal execution — document tombstoning, single-actor hard-gated destruction
ADR-0043: Disposal blob deletion is post-commit, GC-backstopped
ADR-0044: Search FTS baseline — event-indexed, RLS-scoped search_index
ADR-0045: Image Attachments as Content Parts (Rich-Content Slice R2)
ADR-0046: Four-Eyes — Submitter Excluded from Approval
ADR-0047: Four-Eyes — Submitter-Only Exclusion
ADR-0048: Document Organization — Folder Tree per Scope
ADR-0049: Content Model Round 2 — Type Categories, Template Instantiation, Trace Relations, Completeness Rules
ADR-0050: Live Frontend — SSE State Push, CodeMirror 6, Draft Presence
ADR-0051: In-Text Document Links (doc: Scheme)
ADR-0052: Addressees & Read-Acknowledgement (REQ-TRN Realization)
ADR-0053: Addressees Per Document + Process Owner (amends ADR-0052 K-1)
ADR-0054: Process Owner Is a Role (amends ADR-0053 P-3)
ADR-0055: WYSIWYG Editing Mode over Markdown (editor step R4)
ADR-0056: Visual-Editor Chrome via Milkdown Crepe (gated adoption)
ADR-0057: Content Record Is the ProseMirror Document Tree; Markdown Becomes a Derived Projection
ADR-0058: PM_DOC Is the Only Content Format (pre-production cut; amends ADR-0057 §5)
ADR-0059: Editor Engine Switches to TipTap (spike-gated; supersedes the Milkdown/Crepe choice)
ADR-0060: Backup & Restore — Scripted Ordered Backup with Automated Restore Rehearsal
ADR-0061: CSV — Generated Validation Package per Release
ADR-0062: SBOM — CycloneDX over the Production Layers, Validated Against the Artifact
ADR-0063: User Identity Binds on Subject Only (Issuer Becomes Provenance)
ADR-0064: Per-Document Workflow Role Bindings (Author / Reviewer / Releaser), Enforced
ADR-0065: Diagrams — Excalidraw as the Manual Layer, Mermaid Stays for Text-First/UML
ADR-0066: WITHDRAW — the Author Side May Reclaim a Version from Review
ADR-0067: Review Comments — Anchored, Immutable, Resolvable
ADR-0068: Confluence/Jira QMS Import — Staged, Read-Only, Repeatable
ADR-0069: Arbitrary File Attachments — Download-Only Confinement
ADR-0070: Training Questionnaires — Versioned, Auto-Scored, Release-Gated
ADR-0071: Training Plans — Document Obligations + External Trainings & Certifications
ADR-0072: Diagrams — Self-Hosted draw.io Replaces Excalidraw
ADR-0073: Per-Scope QMS Configuration Surface
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
ADR-0075: Source History Import — Continuity Without Forged Audit
ADR-0076: Periodic-review status visibility (completing MVP gap #2)
ADR-0077: Requirement Items — Keyed Blocks Inside Controlled Documents
ADR-0078: Generalized Trace Items (Traceability Model — Stage A)
ADR-0079: Risk & Risk-Control Items (Traceability Model — Stage B)
ADR-0080: Traceability Workspace — Hub, Sub-Pages, and Role-Gated Views
ADR-0081: Draft-Only Trace-Structure Changes, Server-Enforced
ADR-0082: Table-Shaped Risk Authoring over Risk Blocks
ADR-0083: The TD Dossier — a Versioned, Cross-Scope, Regulatory-Structured Deliverable
ADR-0084: Validation & Regulatory Axes (Traceability Model — Stage C)
ADR-0085: Relation-Layer Consolidation — One Trace Vocabulary, One Surface
ADR-0086: Requirement Traceability Chains — End-to-End Path View + Flat Path Export
ADR-0087: The Scope Traceability Report — One Derived Overview Artifact, Never a Controlled Document
ADR-0088: Verification Evidence Classes — Planned vs. Verified, Derived at the Read Layer
ADR-0089: Recurring Obligations — Periodic Tasks With Record Evidence, Not Calendar Series
ADR-0090: Release & Versioning Policy — Deliberate Releases, One Auditor-Facing Number
ADR-0091: Release Modes — Single-Person Record Release With a Structural Four-Eyes Floor
ADR-0092: Orphan-Blob Garbage Collection With a Quarantine Bin
ADR-0093: One Scope Context — the Toolbar Switcher Is the Only Scope Selector
ADR-0094: Calendar-Anchored Obligation Schedules (Clamped, Never Too Late)
ADR-0095: Key-Rule Governance — Free Until First Use, Then Frozen
ADR-0096: Transition Permissions — Always Visible, Deny Unless Granted
ADR-0097: A Governed Provisioning Surface — MANAGE_SCOPES
ADR-0098: Org Chart × Role System — Marriage at the Evidence Level, Never in Authorization
ADR-0099: The User Manual is an In-App Topic Reference, Not a Document
ADR-0100: LQMS Is the Living Quality Management System
ADR-0101: The Executable Validation Journey (PQ Evidence That Cannot Drift)
ADR-0102: Typed Template Variables (text | date | number — and Deliberately No Enum)
ADR-0103: npm audit Joins the Verification Gate as a Second Standing Input
ADR-0104: The Issued Dossier Is a Persisted Artifact of Record — and Clones to a New Draft
ADR-0105: Navigation Information Architecture — Group by Moment-of-Use
ADR-0106: The Client Reflection Follows Assignments, Not Only Content Reach
ADR-0107: The Audit Append Gate Follows Assignment Reach, Not Content Reach
ADR-0108: Mandator Membership — Invite-Accept, with Pre-Assigned Responsibilities
ADR-0109: Organization Founding Is Its Own Process
ADR-0110: The Audit Trail Is Not a Read Model
ADR-0111: The Imported-Person Model, and Project Portability's First Doctrines
ADR-0112: The Element-Kind Catalog — Semantics in the Model, Not Only in the Code
ADR-0113: Project Arrival Import — Records Arrive as They Are, People Arrive as They Were
ADR-0114: The Operating Model Arrives — Roles as Functions, Names as Words, People as This Instance's Decision
ADR-0115: Collaborative Draft Editing — Two Carets, One Truth, Honest Credit
ADR-0116: The System Maintenance Surface — the App Backs Itself Up, the Host Keeps One Dumb Job
ADR-0117: Role Documentation — a Link, a Finding, Per-Source Recognizers; Substitution Rejected
ADR-0118: The Offline QMS Copy — the Repo Carries the Audit Pack, Not a Second Renderer
ADR-0119: Module-Internal Package Structure — Capabilities First, Layers Second, the Root Is the Surface
ADR-0120: The Shared Kernel — the Domain-Exception Vocabulary Leaves the Authorization Module
ADR-0121: The Project Administrator Role — Per-Scope Administration With Read Access, Seeded in the Base Catalog
ADR-0122: Organization-Level Administration — the Cascade Stays, Becomes Visible, and Founds Projects
ADR-0123: Draft Save-Points — Every Save Restorable, Kept for the Life of the Version
ADR-0124: The Birth Path Completes Without Borrowing Content Clothes
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope
ADR-0127: The Base-QMS Layers — One Library, Derived Adaptations, Local Records
ADR-0128: The GLOBAL Cascade Carries Administration, Never Content
ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing
ADR-0132: Dual-Hat Reviewer Satisfaction Is a Declared Policy Choice — the Strict Floor Stays the Default
ADR-NNNN:
</span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" > <div class="md-nav__link md-nav__container"> <a href="../requirements/" class="md-nav__link "> <span class="md-ellipsis"> Requirements </span> </a> <label class="md-nav__link " for="__nav_5" id="__nav_5_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_5"> <span class="md-nav__icon md-icon"></span> Requirements </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../requirements/stakeholder_requirements/" class="md-nav__link"> <span class="md-ellipsis"> Stakeholder Requirements </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/gap-analysis/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Gap Analysis </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_admin/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Administration, Permissions & Onboarding </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_api_ui/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: API & User Interface </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_audit_reporting/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Audit Trail & Regulatory Reporting </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_auth/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Authentication & Session </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_backup/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Backup & Restore </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_catalogs/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Catalogs, Roles & Users </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_data_protection/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Data Protection, Retention & Disposal </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_documents/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Documents, Versions & Storage </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_dossiers/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Technical Documentation Dossiers </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_effectivity/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Effectivity, Periodic Review & Validity </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_gspr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Regulatory Conformity (GSPR / Essential Principles) </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_i18n/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Internationalization </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Life Cycle & Reviews </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_memberships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Mandator Membership & Invitations </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_migration/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Migration & Import </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_nfr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Non-Functional </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_notifications/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Notifications & Tasks </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_obligations/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_relationships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Document Relationships </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_risk/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Risk Management (ISO 14971 Hazards & Controls) </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_sbom/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Software Bill of Materials & Supply-Chain Assurance </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_search/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Search </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_separation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Scopes, Mandators & Separation </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_signatures/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Electronic Signatures </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_training/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Read-Acknowledgement & Questionnaires </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_users/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: User Identity & Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_validation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Design Validation & the Validation Traceability Axis </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" > <div class="md-nav__link md-nav__container"> <a href="../process/" class="md-nav__link "> <span class="md-ellipsis"> Process (IEC 62304) </span> </a> <label class="md-nav__link " for="__nav_6" id="__nav_6_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_6"> <span class="md-nav__icon md-icon"></span> Process (IEC 62304) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../process/configuration_management_plan/" class="md-nav__link"> <span class="md-ellipsis"> Configuration Management Plan </span> </a> </li> <li class="md-nav__item"> <a href="../process/problem_resolution/" class="md-nav__link"> <span class="md-ellipsis"> Problem Resolution Process </span> </a> </li> <li class="md-nav__item"> <a href="../process/risk_management/" class="md-nav__link"> <span class="md-ellipsis"> Risk Management </span> </a> </li> <li class="md-nav__item"> <a href="../process/software_development_plan/" class="md-nav__link"> <span class="md-ellipsis"> Software Development Plan </span> </a> </li> <li class="md-nav__item"> <a href="../process/verification_plan/" class="md-nav__link"> <span class="md-ellipsis"> Verification Plan </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" > <label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0"> <span class="md-ellipsis"> Operations </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_7"> <span class="md-nav__icon md-icon"></span> Operations </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../operations/genesis-installation/" class="md-nav__link"> <span class="md-ellipsis"> Genesis: Birthing an LQMS Installation with a Base Library </span> </a> </li> <li class="md-nav__item"> <a href="../operations/deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Deployment Guide </span> </a> </li> <li class="md-nav__item"> <a href="../operations/server-deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Server Deployment (single Linux host, public HTTPS) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" > <div class="md-nav__link md-nav__container"> <a href="../traceability/" class="md-nav__link "> <span class="md-ellipsis"> Traceability </span> </a> <label class="md-nav__link " for="__nav_8" id="__nav_8_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_8"> <span class="md-nav__icon md-icon"></span> Traceability </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../traceability/matrix/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Traceability Matrix </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" > <div class="md-nav__link md-nav__container"> <a href="../validation/" class="md-nav__link "> <span class="md-ellipsis"> Validation (tool lane) </span> </a> <label class="md-nav__link " for="__nav_9" id="__nav_9_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_9"> <span class="md-nav__icon md-icon"></span> Validation (tool lane) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../validation/templates/ai-authorship-posture/" class="md-nav__link"> <span class="md-ellipsis"> AI-Authorship Posture — How LQMS Is Built, and Why the Validation Evidence Does Not Rest on It (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../validation/templates/intended-use/" class="md-nav__link"> <span class="md-ellipsis"> Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../validation/templates/tool-risk-assessment/" class="md-nav__link"> <span class="md-ellipsis"> Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" > <label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0"> <span class="md-ellipsis"> Regulatory </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_10"> <span class="md-nav__icon md-icon"></span> Regulatory </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../regulatory/mdr-annex-i-skeleton/" class="md-nav__link"> <span class="md-ellipsis"> MDR Annex I — GSPR authoring skeleton (paraphrased) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" > <div class="md-nav__link md-nav__container"> <a href="../user-guide/" class="md-nav__link "> <span class="md-ellipsis"> User guide </span> </a> <label class="md-nav__link " for="__nav_11" id="__nav_11_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_11"> <span class="md-nav__icon md-icon"></span> User guide </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../user-guide/tutorial/" class="md-nav__link"> <span class="md-ellipsis"> Tutorial — from zero to a released document </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/administration/" class="md-nav__link"> <span class="md-ellipsis"> Administering an LQMS Installation </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/diagrams/" class="md-nav__link"> <span class="md-ellipsis"> Diagrams </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/documents-lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Documents & the Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/exports/" class="md-nav__link"> <span class="md-ellipsis"> PDF Exports & the Audit Pack </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/obligations/" class="md-nav__link"> <span class="md-ellipsis"> Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/project-context/" class="md-nav__link"> <span class="md-ellipsis"> The Project Context & App Version </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/review-comments/" class="md-nav__link"> <span class="md-ellipsis"> Review Comments </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/activity-trail/" class="md-nav__link"> <span class="md-ellipsis"> Who did what, when — reading a project's activity </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/admin-scopes/" class="md-nav__link"> <span class="md-ellipsis"> Renaming a project, and what can never change </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/authority-view/" class="md-nav__link"> <span class="md-ellipsis"> Who holds each function here, and what may it do </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/break-glass/" class="md-nav__link"> <span class="md-ellipsis"> The permission I need is held by a role I do not hold — what now? </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/coverage-and-chains/" class="md-nav__link"> <span class="md-ellipsis"> Coverage or chains? — which requirement view answers your question </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/credentials/" class="md-nav__link"> <span class="md-ellipsis"> Your password: changing it, resetting it — and why LQMS never sees it </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/emergency-cover/" class="md-nav__link"> <span class="md-ellipsis"> Who may cover for whom here — declaring emergency cover, and reading where the glass was broken </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/key-rules/" class="md-nav__link"> <span class="md-ellipsis"> Special elements: what a project declares, and when its names freeze </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/memberships/" class="md-nav__link"> <span class="md-ellipsis"> Belonging to an organization: invitations, acceptance, and what they change </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/provisioning-birth-path/" class="md-nav__link"> <span class="md-ellipsis"> How a new organization and project are born </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/review-policies/" class="md-nav__link"> <span class="md-ellipsis"> What a review policy controls, and what an empty grant means </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/setup-wizard-lanes/" class="md-nav__link"> <span class="md-ellipsis"> The setup wizard: the lanes, and what it writes </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/staffing-and-assignments/" class="md-nav__link"> <span class="md-ellipsis"> Staffing people into roles, and the accountable holder </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/technical-dossier/" class="md-nav__link"> <span class="md-ellipsis"> How do I assemble a technical dossier? </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/trace-items/" class="md-nav__link"> <span class="md-ellipsis"> Trace Items — Requirements, Risks & Risk Controls </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/trace-links/" class="md-nav__link"> <span class="md-ellipsis"> Trace Links & the Suspect Cycle </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/traceability-workspace/" class="md-nav__link"> <span class="md-ellipsis"> The Traceability Workspace </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/training/" class="md-nav__link"> <span class="md-ellipsis"> Training & Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#what-gets-an-adr-and-what-doesnt" class="md-nav__link"> <span class="md-ellipsis"> What gets an ADR (and what doesn't) </span> </a> </li> <li class="md-nav__item"> <a href="#rules" class="md-nav__link"> <span class="md-ellipsis"> Rules </span> </a> </li> <li class="md-nav__item"> <a href="#named-organizations" class="md-nav__link"> <span class="md-ellipsis"> Named organizations </span> </a> </li> <li class="md-nav__item"> <a href="#index" class="md-nav__link"> <span class="md-ellipsis"> Index </span> </a> </li> </ul> </nav> </div> </div> </div> <div class="md-content" data-md-component="content"> <article class="md-content__inner md-typeset"> <a href="https://github.com/nburri/lqms/edit/main/docs/decisions/README.md" title="Edit this page" class="md-content__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id="architecture-decision-records">Architecture Decision Records<a class="headerlink" href="#architecture-decision-records" title="Permanent link">¶</a></h1> <p>Every architecturally significant decision is recorded here as a numbered ADR.</p> <h2 id="what-gets-an-adr-and-what-doesnt">What gets an ADR (and what doesn't)<a class="headerlink" href="#what-gets-an-adr-and-what-doesnt" title="Permanent link">¶</a></h2> <p>A decision gets an ADR when it shapes the system's structure, affects a quality goal, constrains future options, or is expensive to reverse. Examples: architecture style, data separation approach, storage/versioning model, choice of framework or persistence layer (tooling, but architecturally constraining).</p> <p>Development-<em>process</em> conventions (commit message format, branching model, formatting, review workflow) do <strong>not</strong> get an ADR — they live in the IEC 62304 process documents (<a href="https://github.com/nburri/lqms/tree/main/docs/process">docs/process/</a>) or <a href="https://github.com/nburri/lqms/blob/main/docs/ai/conventions.md">docs/ai/conventions.md</a>, which are equally version-controlled. When in doubt, ask: "would reversing this decision require touching the system or just our habits?" System → ADR; habits → process docs.</p> <h2 id="rules">Rules<a class="headerlink" href="#rules" title="Permanent link">¶</a></h2> <ul> <li>File name: <code>adr-NNNN-short-kebab-case-title.md</code> (e.g. <code>adr-0001-use-quarkus.md</code>).</li> <li>Use <a href="adr-template/">adr-template.md</a> as the starting point.</li> <li><strong>ADRs are immutable once accepted</strong> — never delete or rewrite an accepted ADR; the record of <em>what was decided when</em> is the point. A later decision <em>amends</em> it via a new ADR.</li> <li>Status flow: <code>proposed</code> → <code>accepted</code> (or <code>rejected</code>). A <strong>fully replaced</strong> ADR gets status <code>superseded by ADR-NNNN</code>; a <strong>partially refined</strong> ADR keeps <code>accepted</code> (the change is captured by the links below, not by flipping the status).</li> <li><strong>Bidirectional links</strong> keep amendments visible from both ends: the newer ADR names what it changes (<code>Refines:</code> / <code>Supersedes:</code>), and the older ADR gets a matching <code>Refined by:</code> / <code>Superseded by:</code> header line <strong>and</strong> a cell in this index's <em>Refined / superseded by</em> column — so a reader of the old ADR can always tell it has been amended.</li> <li>Add every new ADR to the index here and in <a href="../architecture/09_architecture_decisions/">architecture/09_architecture_decisions.md</a> (which references this registry for amendment status).</li> </ul> <h2 id="named-organizations">Named organizations<a class="headerlink" href="#named-organizations" title="Permanent link">¶</a></h2> <p>ADRs cite the first adopter organization by name where its practice produced the decision or the quote that triggered it; LQMS is not specific to that organization, and no cited example requires knowing it.</p> <h2 id="index">Index<a class="headerlink" href="#index" title="Permanent link">¶</a></h2> <p><em>The </em><em>Refined / superseded by</em><em> column is defined above as holding </em><em>back-links only</em><em> — what LATER amended this row's ADR, so a reader of the old ADR can tell it has been amended. </em><em>2026-09-04 link-repair wave:</em><em> the 30 missing back-links and 5 half-marked pairs found by <a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-adr-coherence.md">review-adr-coherence.md</a> were filled, and where a repaired row's cell had been carrying a FORWARD relationship instead ("builds on…", "amends…"), that text moved into the Title cell. </em><em>Known residue:</em><em> roughly a dozen rows from ADR-0072 onward that the wave did not touch still carry forward text in this column (§2.3 of the review) — read those cells as the row's own outgoing relationships, not as amendments to it.</em></p> <table> <thead> <tr> <th>ADR</th> <th>Title</th> <th>Status</th> <th>Refined / superseded by</th> </tr> </thead> <tbody> <tr> <td><a href="adr-0001-content-addressed-document-storage/">ADR-0001</a></td> <td>Content-addressed document storage with PostgreSQL as source of truth</td> <td>accepted</td> <td>ADR-0017, ADR-0029, ADR-0045</td> </tr> <tr> <td><a href="adr-0002-single-instance-scope-hierarchy/">ADR-0002</a></td> <td>Single instance with scope hierarchy and copy-on-derive</td> <td>accepted</td> <td>ADR-0027, ADR-0127</td> </tr> <tr> <td><a href="adr-0003-fixed-lifecycle-configurable-reviews/">ADR-0003</a></td> <td>Fixed life cycle states with configurable review processes</td> <td>accepted</td> <td>ADR-0030, ADR-0066</td> </tr> <tr> <td><a href="adr-0004-global-catalogs-with-scope-activation/">ADR-0004</a></td> <td>Global catalogs for roles and document types with per-scope activation</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0005-modular-monolith/">ADR-0005</a></td> <td>Modular monolith</td> <td>accepted</td> <td>ADR-0036</td> </tr> <tr> <td><a href="adr-0006-three-layer-search/">ADR-0006</a></td> <td>Three-layer search with in-database index and pluggable LLM</td> <td>accepted</td> <td>ADR-0044</td> </tr> <tr> <td><a href="adr-0007-angular-frontend/">ADR-0007</a></td> <td>Angular frontend with server-side-only enforcement</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0008-flyway-and-jooq-codegen/">ADR-0008</a></td> <td>Flyway migrations and jOOQ codegen from the migrated schema</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0009-rls-session-scope-context/">ADR-0009</a></td> <td>RLS enforcement via a session-scoped authorized scope set</td> <td>accepted</td> <td>ADR-0027</td> </tr> <tr> <td><a href="adr-0010-self-managed-qms-internal-mandator/">ADR-0010</a></td> <td>Self-managed QMS via an internal mandator</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0011-authentication-oidc-bff/">ADR-0011</a></td> <td>Authentication via OIDC SSO with server-side (BFF) sessions</td> <td>accepted</td> <td>ADR-0028, ADR-0033</td> </tr> <tr> <td><a href="adr-0012-authorization-and-bootstrap/">ADR-0012</a></td> <td>Permission-based authorization and system bootstrap</td> <td>accepted</td> <td>ADR-0027, ADR-0121, ADR-0128, ADR-0129</td> </tr> <tr> <td><a href="adr-0013-user-identity-lifecycle/">ADR-0013</a></td> <td>User identity lifecycle</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0014-electronic-signatures/">ADR-0014</a></td> <td>Electronic signatures (Part 11 / Annex 11-capable)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0015-effectivity-periodic-review/">ADR-0015</a></td> <td>Document effectivity, periodic review & validity</td> <td>accepted</td> <td>ADR-0038</td> </tr> <tr> <td><a href="adr-0016-retention-disposal-privacy/">ADR-0016</a></td> <td>Data retention, disposal & privacy (FADP / GDPR)</td> <td>accepted</td> <td>ADR-0040, ADR-0042</td> </tr> <tr> <td><a href="adr-0017-multi-part-version-content/">ADR-0017</a></td> <td>Multi-part version content</td> <td>accepted</td> <td>ADR-0029, ADR-0045</td> </tr> <tr> <td><a href="adr-0018-nonfunctional-targets/">ADR-0018</a></td> <td>Non-functional targets (capacity, availability, security)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0019-notifications-and-tasks/">ADR-0019</a></td> <td>Notifications & tasks</td> <td>accepted</td> <td>ADR-0034, ADR-0037, ADR-0041</td> </tr> <tr> <td><a href="adr-0020-internationalization/">ADR-0020</a></td> <td>Internationalization (content language, time zones, formatting)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0021-document-relationships/">ADR-0021</a></td> <td>General typed document relationships</td> <td>accepted</td> <td>ADR-0049, ADR-0085</td> </tr> <tr> <td><a href="adr-0022-training-management-scope/">ADR-0022</a></td> <td>Read-acknowledgement & questionnaires</td> <td>accepted</td> <td>ADR-0052</td> </tr> <tr> <td><a href="adr-0023-migration-import/">ADR-0023</a></td> <td>Migration / import — current released state</td> <td>accepted</td> <td>ADR-0068 → ADR-0075 → ADR-0113 (the current-state-only doctrine reversed)</td> </tr> <tr> <td><a href="adr-0024-draft-cancellation/">ADR-0024</a></td> <td>Draft / in-review cancellation</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0025-disposal-erasure-mechanics/">ADR-0025</a></td> <td>Disposal & erasure mechanics (storage, index, backups)</td> <td>accepted</td> <td>ADR-0042, ADR-0043, ADR-0044</td> </tr> <tr> <td><a href="adr-0026-rls-connection-pool-safety/">ADR-0026</a></td> <td>RLS runtime safety — connection-pool scope isolation</td> <td>accepted</td> <td>ADR-0027</td> </tr> <tr> <td><a href="adr-0027-rls-content-vs-control-plane/">ADR-0027</a></td> <td>RLS boundary — content-plane vs control-plane</td> <td>accepted</td> <td>ADR-0029, ADR-0048</td> </tr> <tr> <td><a href="adr-0028-stateless-session-cookie/">ADR-0028</a></td> <td>Stateless encrypted token-state cookie (no server-side session store)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0029-document-content-model/">ADR-0029</a></td> <td>Document content model — draft-freeze, content-table RLS, append-only audit</td> <td>accepted</td> <td>ADR-0045, ADR-0110</td> </tr> <tr> <td><a href="adr-0030-review-and-lifecycle-model/">ADR-0030</a></td> <td>Review & life-cycle realization model</td> <td>accepted</td> <td>ADR-0046, ADR-0047, ADR-0066 (WITHDRAW joins the state machine), ADR-0096 (transition semantics superseded), ADR-0132</td> </tr> <tr> <td><a href="adr-0031-base-readability-and-derive-mechanics/">ADR-0031</a></td> <td>Released-base readability enforcement & copy-on-derive mechanics</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0032-frontend-realization/">ADR-0032</a></td> <td>Frontend realization — Quinoa, Angular Material, i18n & E2E</td> <td>accepted</td> <td>ADR-0050</td> </tr> <tr> <td><a href="adr-0033-csrf-control-for-bff-session/">ADR-0033</a></td> <td>CSRF control for the BFF session (SameSite + JSON content-type)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0034-notification-events-and-fanout/">ADR-0034</a></td> <td>Notification realization — in-process domain events + system-context fan-out</td> <td>accepted</td> <td>ADR-0035</td> </tr> <tr> <td><a href="adr-0035-fanout-contract-refinements/">ADR-0035</a></td> <td>Fan-out contract as shipped — gate semantics, count disclosure, audit protocol</td> <td>accepted</td> <td>ADR-0046</td> </tr> <tr> <td><a href="adr-0036-repository-layer/">ADR-0036</a></td> <td>Repository layer — services carry rules, repositories carry jOOQ</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0037-task-scheduler-and-reminders/">ADR-0037</a></td> <td>Task scheduler — in-process tick, advisory-lock election, SQL sweep</td> <td>accepted</td> <td>ADR-0039</td> </tr> <tr> <td><a href="adr-0038-periodic-review-realization/">ADR-0038</a></td> <td>Periodic-review realization — derived due date, policy-gated confirmation</td> <td>accepted</td> <td>ADR-0039</td> </tr> <tr> <td><a href="adr-0039-sweep-and-review-contract/">ADR-0039</a></td> <td>Sweep & periodic-review contract as shipped — grants, guards, addressing</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0040-disposal-due-surfacing/">ADR-0040</a></td> <td>Disposal-due surfacing — closure-anchored retention, scope-level legal hold</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0041-email-channel-and-notification-i18n/">ADR-0041</a></td> <td>Email channel & notification i18n — notification-as-outbox, structured messages</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0042-disposal-execution/">ADR-0042</a></td> <td>Disposal execution — document tombstoning, single-actor hard-gated destruction</td> <td>accepted</td> <td>ADR-0043</td> </tr> <tr> <td><a href="adr-0043-disposal-blob-deletion-post-commit/">ADR-0043</a></td> <td>Disposal blob deletion is post-commit, GC-backstopped</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0044-search-fts-baseline/">ADR-0044</a></td> <td>Search FTS baseline — event-indexed, RLS-scoped search_index</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0045-image-attachments-as-content-parts/">ADR-0045</a></td> <td>Image attachments as content parts — draft working area, freeze-to-manifest</td> <td>accepted</td> <td>ADR-0057</td> </tr> <tr> <td><a href="adr-0046-four-eyes-submitter-exclusion/">ADR-0046</a></td> <td>Four-eyes — submitter excluded from approval</td> <td>superseded by ADR-0047</td> <td>ADR-0047, ADR-0096 (transition semantics)</td> </tr> <tr> <td><a href="adr-0047-four-eyes-submitter-only/">ADR-0047</a></td> <td>Four-eyes — submitter-only exclusion (author exclusion removed)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0048-document-folder-tree/">ADR-0048</a></td> <td>Document organization — folder tree per scope</td> <td>accepted</td> <td>ADR-0124 (the empty-scope re-draw of §3's gate)</td> </tr> <tr> <td><a href="adr-0049-content-model-round2/">ADR-0049</a></td> <td>Content model round 2 — type categories, template instantiation, trace relations, completeness rules</td> <td>accepted</td> <td>ADR-0051, ADR-0085</td> </tr> <tr> <td><a href="adr-0050-live-frontend/">ADR-0050</a></td> <td>Live frontend — SSE state push, CodeMirror 6, draft presence</td> <td>accepted</td> <td>ADR-0051</td> </tr> <tr> <td><a href="adr-0051-in-text-document-links/">ADR-0051</a></td> <td>In-text document links — doc: scheme, human-id targets, freeze-time relation sync</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0052-addressees-acknowledgement/">ADR-0052</a></td> <td>Addressees & read-acknowledgement — role-declared, release-fanned, controlled ack records</td> <td>accepted</td> <td>ADR-0053</td> </tr> <tr> <td><a href="adr-0053-addressees-per-document/">ADR-0053</a></td> <td>Addressees per document + process owner (amends ADR-0052 K-1)</td> <td>accepted</td> <td>ADR-0054</td> </tr> <tr> <td><a href="adr-0054-owner-as-role/">ADR-0054</a></td> <td>Process owner is a role (amends ADR-0053 P-3)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0055-wysiwyg-markdown-mode/">ADR-0055</a></td> <td>WYSIWYG editing mode over markdown — Milkdown, byte-identical fidelity gate, entry guard</td> <td>accepted</td> <td>ADR-0057</td> </tr> <tr> <td><a href="adr-0056-editor-chrome-crepe/">ADR-0056</a></td> <td>Visual-editor chrome via Milkdown Crepe (spike-gated, canon fenced)</td> <td>accepted</td> <td>ADR-0057, ADR-0059</td> </tr> <tr> <td><a href="adr-0057-tree-as-record/">ADR-0057</a></td> <td>Content record is the ProseMirror tree; markdown becomes a derived projection</td> <td>accepted</td> <td>ADR-0058</td> </tr> <tr> <td><a href="adr-0058-v2-only-pre-production/">ADR-0058</a></td> <td>PM_DOC is the only content format — pre-production cut (amends ADR-0057 §5)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0059-editor-engine-tiptap/">ADR-0059</a></td> <td>Editor engine switches to TipTap (spike-gated; supersedes Milkdown/Crepe)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0060-backup-restore-mechanism/">ADR-0060</a></td> <td>Backup & restore: scripted ordered backup + automated restore rehearsal</td> <td>accepted</td> <td>ADR-0116 (the primary mechanism moves in-app; <code>backup.sh</code> becomes the drilled fallback)</td> </tr> <tr> <td><a href="adr-0061-csv-validation-package/">ADR-0061</a></td> <td>CSV: generated validation package per release (dogfooded templates)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0062-sbom-posture/">ADR-0062</a></td> <td>SBOM: CycloneDX over production layers, validated against the artifact</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0063-subject-only-identity/">ADR-0063</a></td> <td>User identity binds on subject only (issuer becomes provenance)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0064-per-document-workflow-roles/">ADR-0064</a></td> <td>Per-document workflow role bindings (author/reviewer/releaser), enforced</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0065-diagrams-excalidraw/">ADR-0065</a></td> <td>Diagrams: Excalidraw manual layer + Mermaid for UML (spike-passed)</td> <td>superseded by ADR-0072</td> <td>ADR-0072</td> </tr> <tr> <td><a href="adr-0066-withdraw-from-review/">ADR-0066</a></td> <td>WITHDRAW: the author side may reclaim a version from review</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0067-review-comments/">ADR-0067</a></td> <td>Review comments: anchored, immutable, resolvable</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0068-confluence-jira-import/">ADR-0068</a></td> <td>Confluence/Jira QMS import: staged, read-only, repeatable</td> <td>accepted</td> <td>ADR-0075 (amends M-4/M-7), ADR-0113 (supersedes for real instances)</td> </tr> <tr> <td><a href="adr-0069-file-attachments/">ADR-0069</a></td> <td>Arbitrary file attachments: download-only confinement</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0070-training-questionnaires/">ADR-0070</a></td> <td>Training questionnaires: versioned, auto-scored, release-gated</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0071-training-plans/">ADR-0071</a></td> <td>Training plans: document obligations + external certifications</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0072-diagrams-drawio/">ADR-0072</a></td> <td>Diagrams: self-hosted draw.io replaces Excalidraw</td> <td>accepted</td> <td>supersedes ADR-0065</td> </tr> <tr> <td><a href="adr-0073-scope-configuration-surface/">ADR-0073</a></td> <td>Per-scope QMS configuration surface</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0074-pdf-export/">ADR-0074</a></td> <td>PDF export of released documents — server-side via Apache FOP over the canonical projection</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0075-source-history-import/">ADR-0075</a></td> <td>Source history import: continuity without forged audit</td> <td>accepted</td> <td>amends ADR-0068</td> </tr> <tr> <td><a href="adr-0076-periodic-review-status-visibility/">ADR-0076</a></td> <td>Periodic-review status visibility (due date + history), derived not stored</td> <td>accepted</td> <td>reaffirms ADR-0038</td> </tr> <tr> <td><a href="adr-0077-requirement-items/">ADR-0077</a></td> <td>Requirement items: keyed blocks inside controlled documents</td> <td>accepted</td> <td>ADR-0088</td> </tr> <tr> <td><a href="adr-0078-generalized-trace-items/">ADR-0078</a></td> <td>Generalized trace items: one typed item, type-agnostic engines (traceability model stage A)</td> <td>accepted</td> <td>extends ADR-0077</td> </tr> <tr> <td><a href="adr-0079-risk-items/">ADR-0079</a></td> <td>Risk & risk-control items: ISO 14971 thread, scores recorded (scheme is content) — traceability model stage B</td> <td>accepted</td> <td>builds on ADR-0078</td> </tr> <tr> <td><a href="adr-0080-traceability-workspace/">ADR-0080</a></td> <td>Traceability workspace: overview hub + role-gated sub-pages; QMB training oversight moves out of My training</td> <td>accepted</td> <td>ADR-0093 (the per-view scope selectors are removed)</td> </tr> <tr> <td><a href="adr-0081-draft-only-structure-changes/">ADR-0081</a></td> <td>Draft-only trace-structure changes, server-enforced (409); importer/seed resequenced create→link→release</td> <td>accepted</td> <td>enforces ADR-0049/-0077, follows ADR-0080</td> </tr> <tr> <td><a href="adr-0082-table-shaped-risk-authoring/">ADR-0082</a></td> <td>Table-shaped risk authoring: a grid surface over <code>:::risk</code> blocks — the tree stays the record</td> <td>accepted</td> <td>builds on ADR-0079</td> </tr> <tr> <td><a href="adr-0083-td-dossier/">ADR-0083</a></td> <td>TD dossier: versioned cross-scope regulatory-structured deliverable — doc-version pins, DRAFT→ISSUED, merged PDF + hash-manifest zip; builds on ADR-0074/-0075</td> <td>accepted</td> <td>ADR-0104 (issued dossiers become persisted artifacts of record)</td> </tr> <tr> <td><a href="adr-0084-validation-regulatory-axes/">ADR-0084</a></td> <td>Validation & regulatory axes (traceability Stage C: schema-driven frontend, four new types, conformity + validation views)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0085-relation-layer-consolidation/">ADR-0085</a></td> <td>Relation-layer consolidation: one trace vocabulary over document relations + item links</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0086-requirement-trace-chains/">ADR-0086</a></td> <td>Requirement trace chains: end-to-end path view + flat CSV path export; rides the coverage-engine edge-type-set consolidation; builds on ADR-0077/-0078/-0080</td> <td>accepted</td> <td>ADR-0088</td> </tr> <tr> <td><a href="adr-0087-traceability-report/">ADR-0087</a></td> <td>Scope traceability report: one derived overview artifact (gap digest + sectioned chains), hub download + audit-pack entry — never a controlled document</td> <td>accepted</td> <td>builds on ADR-0086/-0083/-0074</td> </tr> <tr> <td><a href="adr-0088-verification-evidence-classes/">ADR-0088</a></td> <td>Verification evidence classes: planned vs verified derived at the read layer via a per-type evidence flag; evidence dates surfaced</td> <td>accepted</td> <td>refines ADR-0077/-0086</td> </tr> <tr> <td><a href="adr-0089-recurring-obligations/">ADR-0089</a></td> <td>Recurring obligations: periodic QMS tasks with released-record completion evidence, derived due/overdue, inbox fan-out</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0090-release-versioning-policy/">ADR-0090</a></td> <td>Release & versioning policy: semver from v0.8.0 (1.0 = audit-readiness), deliberate communicated releases (tag → report-at-tag → GitHub release), pre-1.0 wire-breaking allowance</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0091-record-release-modes/">ADR-0091</a></td> <td>Release modes: single-person DIRECT release for RECORD-category types with a structural four-eyes floor (PRESCRIPTIVE/TEMPLATE never relaxable)</td> <td>accepted</td> <td>pairs with ADR-0089</td> </tr> <tr> <td><a href="adr-0092-orphan-blob-gc/">ADR-0092</a></td> <td>Orphan-blob garbage collection: quarantine bin (30-day soft delete, registry not file move), explicit reference-column inventory, never-delete-referenced invariant</td> <td>accepted</td> <td>discharges ADR-0025/-0042 GC assumption</td> </tr> <tr> <td><a href="adr-0093-global-scope-context/">ADR-0093</a></td> <td>One scope context: the toolbar switcher is the only scope selector; per-view selectors removed; required views show a neutral picker on ALL that writes the shared state; refines ADR-0080 and the toolbar context switcher the code calls "Amendment B" (see the ADR's citation note)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0094-calendar-anchored-obligation-schedules/">ADR-0094</a></td> <td>Calendar-anchored obligation schedules: INTERVAL/MONTHLY/YEARLY with day-clamping (never too late), occurrence-after-anchor next-due, sweep-derivation parity pinned</td> <td>accepted</td> <td>extends ADR-0089</td> </tr> <tr> <td><a href="adr-0095-key-rule-governance/">ADR-0095</a></td> <td>Key-rule governance: free until first use, then frozen; changes only as an audited, loudly-confirmed exception act</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0096-transition-permission-model/">ADR-0096</a></td> <td>Transition permissions: always visible, deny unless granted; the complete grant set per policy</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0097-scope-provisioning-surface/">ADR-0097</a></td> <td>Governed provisioning surface: MANAGE_SCOPES gates the four birth acts (mandator, scope, type/role activation, key rules), all audited GLOBAL-anchored; 2026-07-30 amendment adds the governed scope-settings update</td> <td>accepted</td> <td>ADR-0109 (§5 — MANAGE_MANDATORS splits out), ADR-0122 (§4 — CREATE_PROJECT splits out, so "one permission gates all four acts" no longer holds)</td> </tr> <tr> <td><a href="adr-0098-org-chart-evidence-marriage/">ADR-0098</a></td> <td>Org chart × role system: marriage at the evidence level (primary staffing bit, derived authority view), never in authorization</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0099-in-app-topic-manual/">ADR-0099</a></td> <td>The user manual is an in-app topic reference (scene-captured, lint-gated), not a controlled document</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0100-living-qms/">ADR-0100</a></td> <td>The name: LQMS is the Living Quality Management System</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0101-executable-validation-journey/">ADR-0101</a></td> <td>The executable validation journey: PQ evidence that cannot drift (journey bundle promoted at release)</td> <td>accepted</td> <td>extends ADR-0090</td> </tr> <tr> <td><a href="adr-0102-typed-template-variables/">ADR-0102</a></td> <td>Typed template variables (text/date/number, deliberately no enum)</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0103-npm-audit-gate/">ADR-0103</a></td> <td>npm audit joins the verification gate as a second standing input (release-blocking, triage-documented)</td> <td>accepted</td> <td>extends ADR-0090</td> </tr> <tr> <td><a href="adr-0104-dossier-artifact-of-record/">ADR-0104</a></td> <td>The issued dossier is a persisted artifact of record and clones to a new draft; plain delete forbidden</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0105-navigation-information-architecture/">ADR-0105</a></td> <td>Navigation grouped by moment-of-use: Work flat, Evidence menu, Admin behind the gear</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0106-assignment-based-reflection/">ADR-0106</a></td> <td>Client reflection follows assignments, not only content reach (the fresh-install dead-end, half 1)</td> <td>accepted</td> <td>pairs with ADR-0107</td> </tr> <tr> <td><a href="adr-0107-audit-append-follows-assignment-reach/">ADR-0107</a></td> <td>Audit append follows assignment reach — "write where you are staffed, read what you may view"; amended: enforcement counts resolve on true state</td> <td>accepted</td> <td>realizes V080-V086</td> </tr> <tr> <td><a href="adr-0108-mandator-membership/">ADR-0108</a></td> <td>Mandator membership: invite-accept for everyone, pre-assigned responsibilities, redemption-time evaluation; wave 2 = email branch, provider-minted credentials</td> <td>accepted</td> <td>—</td> </tr> <tr> <td><a href="adr-0109-organization-founding-is-its-own-process/">ADR-0109</a></td> <td>Organization founding is its own process: operator-only workflow, project step never creates a tenant, narrow empty-org dissolve, MANAGE_MANDATORS splits from MANAGE_SCOPES; amends ADR-0097</td> <td>accepted</td> <td>ADR-0122 (§4 — CREATE_PROJECT splits out too; §5's "MANAGE_SCOPES keeps project-scope create" is stale)</td> </tr> <tr> <td><a href="adr-0110-audit-trail-is-not-a-read-model/">ADR-0110</a></td> <td>The audit trail is not a read model: written by every act, read only to be shown or counted — promoted facts (V088 shape) answer business questions</td> <td>accepted</td> <td>refines ADR-0029</td> </tr> <tr> <td><a href="adr-0111-imported-person-model-and-project-portability/">ADR-0111</a></td> <td>Imported persons are external: unbound, uninvitable, provenance-marked; never auto-merge on email (bulk-but-explicit link); source trail travels as evidence artifact; importer = step one of the generic transfer arc</td> <td>accepted</td> <td>builds on ADR-0108/-0110</td> </tr> <tr> <td><a href="adr-0112-element-kind-catalog/">ADR-0112</a></td> <td>The element-kind catalog: kinds carry semantics + dependencies in the MODEL; scopes activate kinds (key rule = the visible half); custom kinds as a semantics-free tier; extending the well-known set is a product act with chains-as-data; per-scope labels+prefixes frozen at first use</td> <td>accepted</td> <td>re-founds the #33k arc; builds on ADR-0086/-0095</td> </tr> <tr> <td><a href="adr-0113-project-arrival-import/">ADR-0113</a></td> <td>Project arrival import: released documents arrive released with their true approved bodies, source dates and EXTERNAL authors; nothing backdated ever; D1 cage structural; Amendment 1 — head-only floor by design (ceremony-fingerprint premise falsified by the full-corpus oracle)</td> <td>accepted</td> <td>builds on ADR-0110/-0111</td> </tr> <tr> <td><a href="adr-0114-operating-model-arrival/">ADR-0114</a></td> <td>The operating model arrives with the corpus: roles as functions with the mapping preview, one-transaction policy arrival, per-document source bindings; §7 — dissolve locked by the first LOCAL release</td> <td>accepted</td> <td>builds on ADR-0113</td> </tr> <tr> <td><a href="adr-0115-collaborative-draft-editing/">ADR-0115</a></td> <td>Collaborative draft editing mainline: recovery buffer, session lock, honest credit — the contributor set as frame-fact read from the real trail; reconnect + SSE meta-sync; no feature flag</td> <td>accepted</td> <td>realizes V100</td> </tr> <tr> <td><a href="adr-0116-system-maintenance-surface/">ADR-0116</a></td> <td>The system maintenance surface: the app backs itself up (async audited pg_dump + blob archive into its own volume, image-pinned client), backup evidence + NO_VERIFIED_BACKUP finding + job heartbeats on Admin → System; the host keeps one dumb sync job; restore stays deploy-level</td> <td>accepted</td> <td>realizes V102; EXPORT_BACKUP finds its home</td> </tr> <tr> <td><a href="adr-0117-role-documentation/">ADR-0117</a></td> <td>Role documentation: described_by link on the role ACTIVATION (manual / import recognizer / cross-scope), ROLE_WITHOUT_DESCRIPTION setup finding (staffed+activated, warn not block), per-source recognizers; substitution REJECTED as <em>acting-as</em> — staffing is the mechanism, time-boxed staffing the named trigger; builds on ADR-0114/-0098</td> <td>accepted</td> <td>ADR-0130 + ADR-0131 — <strong>the named trigger FIRED 2026-09-01</strong>: the acting-as refusal stands, time-boxed staffing was built and the declared substitution matrix rides it. This ADR's own realization (<code>described_by</code>, ROLE_WITHOUT_DESCRIPTION, recognizers) is still unbuilt — <a href="https://github.com/nburri/lqms/blob/main/docs/planning/open-decisions.md">open-decisions</a> row 62</td> </tr> <tr> <td><a href="adr-0118-offline-qms-copy/">ADR-0118</a></td> <td>Offline QMS copy: the scope audit pack committed to the repo as loose PDFs + manifest.json — reuses ADR-0074's §4.2.4 header/footer and ADR-0083's sha256 manifest, so NO second renderer; index.md the pointer that survives alone; two-question drift split; eligibility opt-in per scope</td> <td>accepted</td> <td><strong>in 1.0</strong> — open decision 10 (eligibility) ruled 2026-08-24, 1.0 inclusion confirmed 2026-09-04; only the pack-size measurement remains before implementation (<a href="https://github.com/nburri/lqms/blob/main/docs/planning/v1.0-criteria.md">v1.0-criteria</a> C-4d)</td> </tr> <tr> <td><a href="adr-0119-module-internal-package-structure/">ADR-0119</a></td> <td>Module-internal package structure: capability packages first, layer packages second (closed at ADR-0036's service/repository), capability root = published surface (promotion is a visible move, killing api/model churn), ONE cross-capability rule (never import a sibling's repository/), Kotlin file-privacy absorbs internal DTOs, ports for behavioral seams; Konsist enforces in the same wave</td> <td>accepted</td> <td>rides with the scope split, before the export twin; realization queued</td> </tr> <tr> <td><a href="adr-0120-shared-kernel-module/">ADR-0120</a></td> <td>The shared kernel: the domain-exception vocabulary (<code>DomainExceptions.kt</code>, <code>requireValid</code>/<code>checkState</code>) leaves the authorization module for a dependency-free <code>common</code> module — <code>scope</code> becomes purely authorization + tenancy; <code>RlsScopeContext</code> and <code>TransactionPostCommit</code> deliberately stay</td> <td>accepted</td> <td>rides with ADR-0119; closes the 2026-08-18 review's <code>scope</code> finding</td> </tr> <tr> <td><a href="adr-0121-project-administrator-role/">ADR-0121</a></td> <td>Project Administrator role: seeded, bootstrap-ensured per-scope administration (ASSIGN_ROLES, MANAGE_USERS, ACTIVATE_CATALOG_ENTRIES, CONFIGURE_REVIEW_POLICY, MANAGE_TRAINING) plus read-class content (VIEW, VIEW_TRACEABILITY) — admin≠content stays absolute at GLOBAL, deviates at project level behind the project's own activation+staffing act; authoring/approval and records-governance permissions OUT deliberately; permission-vocabulary classification guard test</td> <td>accepted</td> <td>realization rides v0.9.16; ADR-0114 name-adoption consequence stated</td> </tr> <tr> <td><a href="adr-0122-organization-level-administration/">ADR-0122</a></td> <td>Org-level administration: cascade kept as documented contract (sovereignty flows downhill), cascaded holders rendered as derived "via organization" rows wherever evaluators count them, warning on org-activating authoring-class roles (flexible per org — no catalog flag until a proven variation point), CREATE_PROJECT split from MANAGE_SCOPES checked at the target org's anchor, wizard birth path opens to org admins</td> <td>accepted</td> <td>realization rides v0.9.18</td> </tr> <tr> <td><a href="adr-0123-draft-save-points/">ADR-0123</a></td> <td>Draft save-points: save-level (never keystroke) restore history, retained for the LIFE of the version incl. post-release (his reconstruction use case), deleted by disposal / reached by dissolution, restore = new audited save with provenance, visibility follows DRAFT access not VIEW</td> <td>accepted</td> <td>IN SCOPE FOR v1.0 (his ruling); new FORCE-RLS table — the inventory guard will demand classification</td> </tr> <tr> <td><a href="adr-0124-birth-completes-without-content-clothes/">ADR-0124</a></td> <td>Birth without content clothes: while a scope holds ZERO documents, folder creation is a setting-up act (ACTIVATE_CATALOG_ENTRIES in scope; first record → ORGANIZE_DOCUMENTS governs; empty-scope line checked in the write transaction, V106 pattern); the wizard stops recommending self-staffing across the admin≠content boundary; staffing bridge accepts hand-added roles; re-entry via the governable union; filtered offers named</td> <td>accepted</td> <td>his boundary insight; realization = the next wave</td> </tr> <tr> <td><a href="adr-0125-portability-export-twin/">ADR-0125</a></td> <td>The export twin: export emits an ARRIVAL BUNDLE (one exporter, the battle-proven consumer); unit = project + declared dependency manifest; fidelity line = released corpus travels, acts stay (ADR-0075 red line; migration loses the working-record layer BY DESIGN, said in bold); in-app audited EXPORTED act (PackWriter pattern, EXPORT_PROJECTS@GLOBAL); export is a read, V106 one-shot governs the target; cross-scope refs re-bind by identity, never tree export (you export what you own)</td> <td>accepted</td> <td>Amendment 1: id-adoption (batch-only, counter seeded), REVOKED as state, treeJson beside the md; Amendment 2 (the base-library landing): idsAuthoritative extends to adopted-EMPTY scopes (V118), the id namespace is the BUNDLE's declared code behind an explicit flag, mandator check only where the target has one; round-trip count-diff = the C-4 evidence</td> </tr> <tr> <td><a href="adr-0126-project-dissolution/">ADR-0126</a></td> <td>Project dissolution: mayBeDissolved pre-resolved on project rows (null to the ungated); gate = CREATE_PROJECT at the org anchor (creation's mirror); line in two slices — zero documents now, V106 working-record line next (drafts destroyed with counted consent, a native release blocks: it is a witnessed approval act); V113 destroyer re-checks past RLS, delete set from pg_constraint; SCOPE_DISSOLVED beside SCOPE_CREATED at the org anchor, event-then-destroy one transaction; departure dissolve = separate act riding the export twin (verified export + named final backup cited); any-status sysadm kill switch REJECTED (the wall argument recorded); sandbox scope kind named as the post-1.0 direction</td> <td>accepted</td> <td>wave-1 lane dispatched; slice 2 after it proves the pattern</td> </tr> <tr> <td><a href="adr-0127-base-qms-layering/">ADR-0127</a></td> <td>Base-QMS layers: consumption-defined — base library = the one GLOBAL scope read in place (BASE_READ, released face only), templates = derive masters (adapt + SOURCE_UPDATED drift, never auto-propagated), records stay; tool-operational docs migrate-then-REVOKE-then-supersede (his amendment — the transition itself becomes QMS evidence; revocation wave only AFTER import acceptance, the one-shot window); Base Reader role auto-assigned at GLOBAL; picker demotes (never hides) a mastered-here template; row 29 = refuse with the remedy in hand (missing kinds named, one-click activation for the authorized); migration = export twin bundle-split; base-library UPDATE imports sequenced-after</td> <td>accepted</td> <td>Amendment 1 (2026-08-29): the visibility doctrine — the four faces (strangers nothing; readers who-did never who-may; members full process transparency; participants the working layer); build wave: reader role + picker demotion + derive refusal; instance migration scheduled by the owner</td> </tr> <tr> <td><a href="adr-0128-global-cascade-classification/">ADR-0128</a></td> <td>The GLOBAL cascade carries administration, never content: from a GLOBAL assignment only ADMINISTRATIVE-class permissions cascade; CONTENT-class permissions are effective in GLOBAL alone (ADR-0121's guarded classification becomes structural — QMB@GLOBAL = library authoring with zero project reach; lqms-admin and Base Reader unchanged by construction; MANDATOR-anchor cascade untouched)</td> <td>accepted</td> <td>his catch at the library-staffing question; V005 slice to build</td> </tr> <tr> <td><a href="adr-0129-global-role-identity/">ADR-0129</a></td> <td>Role identity from a GLOBAL assignment acts in GLOBAL alone: workflow authority (role-gated — approve/release/revoke have no permission) stops cascading from GLOBAL; MANDATOR-anchor role cascade deliberately KEPT (org staffing is a ruled feature, stops at the org boundary); one shared predicate across lqms_effective_roles + every holder/authority/fan-out sibling</td> <td>accepted</td> <td>the residual half of his catch; ships BEFORE genesis staffing (G-5)</td> </tr> <tr> <td><a href="adr-0130-break-glass-escalation/">ADR-0130</a></td> <td>Break-glass: the project administrator's escalation is a first-class, witnessed, self-expiring act — PA's permission set UNCHANGED (no standing content rights: ASSIGN_ROLES was always the master key, so the boundary is a witness, not a capability limit); refusals become doors (missing permission + holding roles named, inline audited self-staffing for ASSIGN_ROLES holders); permission closure surfaced at import + a setup-status dead-end check; TIMED self-staffing (30/60 min, 1 day; default 60) enforced in the authorization predicate — expires_at filtered on the assignment READS, never a job, keeping the ADR-0129 inlined predicate immutable; header chip while active, doubling as the pre-expiry warning</td> <td>accepted</td> <td>closes row 48 (all three layers); realizes ADR-0117's time-boxed-staffing trigger; §6 resequenced into 1.0 by ADR-0131</td> </tr> <tr> <td><a href="adr-0131-role-substitution-edges/">ADR-0131</a></td> <td>Role substitution as declared adoption edges: "A may take over B" authorizes a holder of A to SELF-STAFF into B — own name, witnessed, timed (the ADR-0130 mechanism; ADR-0117's acting-as rejection load-bearing — four-eyes stays intact because the substitute IS a different person); the matrix is operating-model content (per-scope governance act, travels in the arrival bundle, the declaration IS the qualification statement); hard constraint: CONTENT-class targets only, refused at declaration via the ADR-0128 classification (no master key through a side door; absent PA covered via ADR-0122, not the matrix); emergency ≠ planned absence (short presets self-service; vacations = ordinary deputy staffing by the PA); not built: transitive edges, cross-scope edges, impersonation</td> <td>accepted</td> <td>his feature, ruled IN 1.0 — resequences ADR-0130 §6; mechanism + matrix land as one arc after the 1.0 fix waves</td> </tr> <tr> <td><a href="adr-0132-dual-hat-reviewer-policy/">ADR-0132</a></td> <td>Dual-hat reviewer satisfaction is a declared policy choice: a per-(scope, type) review-policy flag — <em>one person may satisfy multiple role requirements</em> — <strong>default OFF</strong>, so today's cross-role distinct-person floor stands everywhere until a scope's governance opts in (a witnessed <code>CONFIGURE_REVIEW_POLICY</code> act that travels in the arrival bundle); untouched by the flag: within-role distinctness, four-eyes (≥2 humans per release, always), one approval = one declared role (ADR-0064 D-4a); "Approve as <Role>" ships UNCONDITIONALLY; the global change rejected as undeclared semantic weakening (the row-52 defect class); implementation post-1.0 (his ruling)</td> <td>accepted</td> <td>refines ADR-0030 point 4</td> </tr> </tbody> </table> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type="button" class="md-top md-icon" data-md-component="top" hidden> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> Back to top </button> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="../architecture/arrival-bundle-format/" class="md-footer__link md-footer__link--prev" aria-label="Previous: The arrival bundle format"> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class="md-footer__title"> <span class="md-footer__direction"> Previous </span> <div class="md-ellipsis"> The arrival bundle format </div> </div> </a> <a href="adr-0001-content-addressed-document-storage/" class="md-footer__link md-footer__link--next" aria-label="Next: ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth"> <div class="md-footer__title"> <span class="md-footer__direction"> Next </span> <div class="md-ellipsis"> ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> <div class="md-copyright__highlight"> Built from <code>v0.9.56-4-g06c7f811</code> (commit <code>06c7f811</code>, 2026-09-09) — the same Markdown the repository ships. </div> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"base": "..", "features": ["navigation.instant", "navigation.tracking", "navigation.top", "navigation.footer", "navigation.indexes", "toc.follow", "search.suggest", "search.highlight", "content.code.copy", "content.action.edit"], "search": "../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src="../assets/javascripts/bundle.83f73b43.min.js"></script> </body> </html>