Skip to content

Architecture Decision Records (ADRs)

Document ID: ADR-INDEX-001
File Path: docs/17-adr/index.md
Version: 1.4.0
Status: Active
Owner: Architecture Team
Last Updated: 2026-07-17


This section records the significant architectural decisions for the Wovyr AI Platform — the why behind major choices — so future contributors understand the reasoning and the trade-offs that were accepted.


An ADR captures a single decision with its context and consequences. ADRs are immutable once accepted: to change a decision, write a new ADR that supersedes the old one (the old one stays, marked Superseded).


Title · Status · Context · Decision · Consequences · Alternatives Considered

Status is one of: Proposed, Accepted, Superseded by ADR-XXXX, Deprecated.


ADRDecisionStatus
ADR-0001Monorepo + crate/service structureAccepted
ADR-0002Rust as the implementation languageAccepted
ADR-0003PostgreSQL as system of recordAccepted, narrowed for GA — opt-in, not universal (see ADR’s Current Status)
ADR-0004Qdrant for vector searchAccepted, opt-in for GA (see ADR’s Current Status)
ADR-0005NATS JetStream for the event busAccepted, not implemented — deferred to v1.1 (see ADR’s Current Status)
ADR-0006Clean Architecture + DDDAccepted
ADR-0007Plugin-first extensibilityAccepted
ADR-0008Child workflows as activities (not inline expansion)Accepted
ADR-0009Wovyr-native keyless signing (Sigstore-shaped, offline-verifiable)Accepted
ADR-0010GA as single-node appliance (Path A); distributed platform (Path B) as v1.1 follow-onAccepted
ADR-0011Reposition the product as the Generative UI Trust Runtime (platform becomes the engine; open UI shapes adopted, not invented; constrained component vocabulary; no browser)Accepted
ADR-0012Trust boundary for user-managed MCP connections: Stdio transport gated like the shell tool (operator opt-in + mcp:admin); Http transport reuses the existing SSRF guard; credentials are vault references; no sandboxing of Stdio in v1 (stated residual risk)Accepted
ADR-0013First-party client SDKs stay TypeScript + Python; Go/Java are a documented non-goal — the generated /openapi.json (CI-gated ground truth) is the supported path for other languages, with a recorded revisit triggerAccepted

ADRs record decisions; the Architecture docs describe the resulting design. When they conflict, the latest accepted ADR wins and the design docs should be updated.


VersionDateDescription
1.4.02026-07-17Added ADR-0013 (client SDK languages: TS+Python only, OpenAPI generation as the path for others — closes DX-306)
1.3.02026-07-15Added ADR-0012 (trust boundary for user-managed MCP connections)
1.2.02026-07-14Added ADR-0011 (Generative UI Trust Runtime repositioning)
1.1.02026-07-07Annotated ADR-0003/0004/0005’s Status column: none of the three were fully executed as originally decided (Postgres/Qdrant are opt-in not universal; NATS was never implemented at all). Each ADR now has its own Current Status section with detail. Found during a project-wide doc review
1.0.02026-06-27Initial ADR register