Architecture decision records
Architecture decision records (ADRs) preserve why a durable technical choice was made. They complement the current-state architecture guide, which describes what exists now.
Index
| ADR | Status | Decision |
|---|---|---|
| 0001 | Accepted | Use a Cargo workspace with inward dependencies |
| 0002 | Partially superseded by 0019 | Keep plugins behind a source-level Rust trait boundary |
| 0003 | Accepted | Separate core event contracts from scanner event delivery |
| 0004 | Accepted | Keep deterministic reasoning inward of execution and runtime |
| 0005 | Accepted | Share predicate vocabulary through venom-core |
| 0006 | Accepted | Keep API visibility ingestion outside the decision runner |
| 0007 | Accepted | Make ScanContext constructor-owned and non-exhaustive |
| 0008 | Accepted | Version API comparison projections outside the core wire contract |
| 0009 | Superseded by 0012 | Make the standard runtime own transport accounting |
| 0010 | Accepted | Select payload strategies without moving payloads into planning |
| 0011 | Accepted | Version API explanation semantics |
| 0012 | Accepted | Account delivered transport bytes at the broker boundary |
| 0013 | Accepted | Run authorized API visibility pairs as a runtime-owned workflow |
| 0014 | Superseded by 0017 | Consolidate runtime truth into three named surfaces |
| 0015 | Build inventory superseded by 0020; classification axes retained | Classify the platform shell by execution reality |
| 0016 | Accepted; phase 5–9 inventory superseded by 0018 | Bound legacy discovery behind a shared authority |
| 0017 | Accepted | Make the deterministic runtime the canonical scan command |
| 0018 | Accepted | Bound legacy verification behind a separate active authority |
| 0019 | Accepted | Make plugin execution host-owned and evidence-only |
| 0020 | Accepted; reporting clause superseded by 0021, Lua/distributed clauses by 0022 | Quarantine platform and distribution surfaces |
| 0021 | Accepted; CLI-composition statements superseded by 0023 | Render bounded typed run reports without adding verdict authority |
| 0022 | Accepted | Bound host-owned Lua execution and process-local coordination |
| 0023 | Accepted | Compose opt-in profiled assessment reporting at the CLI boundary |
| 0024 | Accepted | Establish a separate bounded exploit manifest and catalog domain without execution authority |
| 0025 | Accepted; detector recovery clause extended by 0026 | Record component-level historical scanner salvage before restoring capability |
| 0026 | Accepted | Restore only bounded artifact-signature observations in a separate domain |
| 0027 | Accepted | Record the separate post-workspace WAF/evasion quarantine epoch without restoring runtime authority |
| 0028 | Accepted | Reuse eligible committed pages before one WordPress metadata schedule |
Format
New records use the next four-digit number and contain: Status, Context, Decision, Consequences, and Alternatives considered. Accepted ADRs are immutable; supersede one with a new ADR instead of rewriting history.
