# Architecture decisions

Nonfinal proposals. See [Jonathan’s decision list](../architecture/decisions-for-jonathan.md).

- [ADR-001 Three deployable roles; resolver as a modular monolith](adr_001-service-and-module-boundaries.md)
- [ADR-002 One PostgreSQL instance, schemas resolver and product, enforced by roles](adr_002-shared-postgres-schemas-and-roles.md)
- [ADR-003 Relational accepted state + immutable evidence/decisions + transactional outbox, not event sourcing](adr_003-relational-state-with-outbox.md)
- [ADR-004 Transactional cursor, pinned rebuild and restored-history fence](adr_004-projection-bootstrap-and-recovery.md)
- [ADR-005 Versioned typed attribute definitions; identity evolution through impact analysis and review](adr_005-attribute-definition-versioning.md)
- [ADR-006 LLM extractor and reviewer as capability-limited actors](adr_006-llm-actor-permissions.md)
- [ADR-007 Ports and adapters; TypeScript + Hono + Workers + PostgreSQL/Hyperdrive + R2 + Queues](adr_007-ports-adapters-and-initial-stack.md)
- [ADR-008 Tenant-private catalogs with independent catalog identity](adr_008-tenancy-aware-keys.md)
- [ADR-009 At-least-once, refs-only job transport with ack after durable write](adr_009-job-transport-semantics.md)
- [ADR-010 Product projection store](adr_010-product-projection-store.md)