Skip to content

README.md

Latest commit

 

History

History
125 lines (115 loc) · 7.9 KB

README.md

File metadata and controls

125 lines (115 loc) · 7.9 KB
Raw

Stadtstack architecture decisions

Read this index before treating an older ADR as current architecture. The public repository records contracts and boundaries; it does not authorize publication, runtime operations, public relay writes, or civic effects.

Accepted baseline

  • ADR 0037 — route explicitly configured synthetic Cases through one writer, retaining separate Case credentials, the original default and public Brief bindings.

  • ADR 0036 — activate the exact review migration on a separate target, retaining the sealed source and resuming interrupted imports through linked receipts.

  • ADR 0035 — compose review with the existing durable owner through a separately pinned listener.

  • ADR 0034 — prepare a verified review-capable copy of a sealed synthetic admission without changing the source or authorizing deployment.

  • ADR 0033 — connect municipal role mapping, scoped workspace review and the explicit synthetic lane.

  • ADR 0001 — keep the coordination Module neutral and separate city products and private operations.

  • ADR 0003 — prove one synthetic runtime path before external authority or federation.

  • ADR 0004 — signed Nostr discussion is provenance, not case or municipal authority.

  • ADR 0005 — one owner for each product, source, and authority boundary.

  • ADR 0006 — companion and workspace products remain replaceable Adapters.

  • ADR 0007 — publish from one clean public root commit and keep operations private.

  • ADR 0008 — use a durable append-only Case journal behind a two-operation coordinator.

  • ADR 0009 — use Nostr for signed discussion and reviewed public exchange, not private case state.

  • ADR 0010 — keep reference surfaces and agent identities role-scoped.

  • ADR 0011 — let public Mecky answer explicit questions from cited reviewed knowledge and let the resident sign an edited suggestion without submitting it.

  • ADR 0012 — admit an exact citizen signature through a human steward, then carry one reviewed public projection through Citizen Brief, advisory Mitmachen, and the outcome backlink without creating voting authority.

  • ADR 0013 — keep the public journey Topic-first, then let one accountable human atomically create the deterministically identified Case and admit the exact citizen signature.

  • ADR 0014 — bind one Department package to a replaceable municipal workspace and accept its exact return only as a draft that still needs independent human review.

  • ADR 0015 — expose checksum-bound Department review readiness, then let only a human Case steward prepare the exact Citizen Brief derivation command.

  • ADR 0016 — admit exact captured news and council records through a human source review, then prepare the checksum-bound public projection consumed by Röbel without publishing it.

  • ADR 0017 — expose already prepared source snapshots through two exact GET-only routes in a loopback reference transport without adding source or civic write authority.

  • ADR 0018 — isolate human Case admission behind a staff-authenticated control seam and expose only a checksum-bound, GET-only public Case binding receipt.

  • ADR 0019 — compose administration feedback, Citizen Brief, advisory Mitmachen, and reviewed outcome over the same admitted Case and durable journal rather than Mini App timelines.

  • ADR 0020 — put staff-only Case control, credential-free Case discovery, and outbox hydration behind disjoint, bounded transport capabilities.

  • ADR 0021 — use per-steward staging tokens and a private credential-free outbox pull to connect separate control and public binding workloads.

  • ADR 0022 — compose the separate control and public processes on loopback, prove the complete HTTP tracer, and require verified Operations policy before network exposure.

  • ADR 0023 — give the staging control process one reviewed single-writer claim and block activation until a quiesced encrypted backup has been restored and verified on a fresh claim.

  • ADR 0024 — use one municipality-scoped durable Case ID and block activation of legacy staging-identity stores rather than rewriting checksum-bound evidence.

  • ADR 0031 — verify citizen adoption, trusted ledger acceptance and fresh eligibility in the staff-authorized atomic Case admission and replay its original receipt.

  • ADR 0032 — admit test Citizen Pass tracers into a separate synthetic Case namespace through the existing journal, with explicit test-only receipts.

Proposed extensions

  • ADR 0025 — keep Meld/Kair session bundles consent-scoped and review-gated rather than treating a recording-derived artifact as identity, source authority, or a Case.
  • ADR 0026 — publish one replayable eligibility-gated change feed and keep MCP and Nostr as bounded Adapters over the same Public knowledge projection.
  • ADR 0027 — use cross-municipality similarity for public-safe discovery without merging identity, consent, Cases, or municipal authority.
  • ADR 0028 — extract one framework-neutral Civic coordination kernel and split public and staff surfaces into independently built and deployed applications.
  • ADR 0029 — gate any Röbel cryptographic ballot on a provider-neutral Citizen credential bridge and an explicit cross-municipality compatibility/ownership decision; never reopen the expired pilot or imply treasury authority.
  • ADR 0030 — close the administration-to-public-context loop through an explicit municipal publication candidate and receipt, then expose official OParl-compatible and broader reviewed civic-context views without inventing “OParl 2.”

Historical

  • ADR 0002 — the original one-city test ladder, retained as context.

An ADR records architecture. It is not an authorization for repository visibility changes, public relay publication, deployment, provider access, voting, or other civic effects.