Architecture Decision Records (ADRs)
This directory is the canonical home for all accepted Architecture Decision Records in the Stella Ops monorepo. Filenames follow the ADR-NNN-kebab-slug.md format and numbering is monotonic and never reused.
RFCs (proposals) live elsewhere. An RFC is a proposal under discussion, not an accepted decision. RFCs are kept in
docs/rfcs/. Once an RFC is accepted and the decision is settled, capture it as an ADR here.
History note: ADR-013 through ADR-019 were consolidated from the root of docs/architecture/ (they carried descriptive ADR-*.md names), and ADR-020 through ADR-022 were consolidated from docs/technical/adr/ (legacy 0042–0044 numbering). Each moved file records its former path near the top.
Index
| ADR | Title | Status | Date |
|---|---|---|---|
| ADR-001 | Linkset Correlation Algorithm V2 | Accepted | 2026-01-25 |
| ADR-002 | Multi-Tenant Selection With Same API Key | Accepted | 2026-02-22 |
| ADR-003 | Concelier Export Center Air-Gap Alignment | Accepted | 2026-05-16 |
| ADR-004 | Forward-Only Database Migrations | Accepted | 2026-05-18 |
| ADR-005 | Single-Operator Multi-Environment Tenancy | Accepted | 2026-05-18 |
| ADR-006 | Execution Plugin Framework | Accepted | 2026-05-25 |
| ADR-007 | KEK Lifecycle and Rotation | Accepted | 2026-05-27 |
| ADR-008 | Credential Storage Regional Algorithm Routing | Accepted | 2026-05-27 |
| ADR-009 | Component per-environment registry override (JSONB-on-aggregate) | Accepted (retroactive) | 2026-05-28 |
| ADR-010 | Shared tenant-resolver migration — retire the Guid-only helpers | Accepted | 2026-05-29 |
| ADR-011 | EPF plugin service contract — manifest-declared requires + host service registry (Pattern Z) | Accepted (design-only) | 2026-05-29 |
| ADR-012 | Per-tenant system-account client_credentials clients auto-seeded during tenant onboarding (Pattern C) | Accepted | 2026-05-29 |
| ADR-013 | Findings Runtime Disabled Mode | Accepted | 2026-04-28 |
| ADR-013 ⚠️ | .NET Callgraph Extractor — Dual-Mode (M1 restore-aware + M2 lightweight) at scan-rootfs | Accepted | 2026-05-30 |
| ADR-014 | Findings Runtime Persistence | Accepted | 2026-04-28 |
| ADR-015 | Findings Runtime Privacy Filter | Accepted | 2026-04-28 |
| ADR-016 | Findings Runtime Score Formula | Accepted | 2026-04-29 |
| ADR-017 | Findings Runtime Score Recompute Async-Migration Trigger | Accepted | 2026-04-29 |
| ADR-018 | Notify external-ID column projection | Accepted | 2026-04-29 |
| ADR-019 | VEX signature verification as a mandatory ingest gate | Accepted | 2026-05-01 |
| ADR-020 | CGS Merkle Tree Implementation (legacy ADR 0042) | Accepted | 2025-12-29 |
| ADR-021 | Fulcio Keyless Signing with Optional Parameter (legacy ADR 0043) | Accepted | 2025-12-29 |
| ADR-022 | Binary Delta Signatures for Backport Detection (legacy ADR 0044) | Accepted | 2026-01-03 |
| ADR-023 | Console admin tenant switch strategy | Accepted | — |
| ADR-024 | Internal OCI metadata registry, opt-in upstream attachment, and attachment-state | Accepted (design-only) | 2026-06-04 |
| ADR-025 | Operator-signed governance decisions (per-account keys, verified through the crypto abstraction) | Accepted (partial implementation in progress) | 2026-06-08 |
| ADR-028 | Verification root-key rotation & signed-material re-enveloping (phased dual-trust introduce → re-envelope → consequences-gated invalidate) | Accepted | 2026-06-10 |
| ADR-029 | Console-internal service-account transport + verified on-behalf-of operator attribution (canonical service-account pattern) | Accepted | 2026-06-11 |
| ADR-030 | Region-aware, per-plugin signing (runtime-bundle.v2 multi-sig + fail-closed signing-root verification) and digest-pinned OCI artifact release | Accepted | 2026-06-11 |
| ADR-031 | Unified Secret Provider (built-in floor; ISecretProvider over builtin/vault/openbao; master-key-at-setup generate+import, symmetric+asymmetric, fail-closed; §D5 amended 2026-07-04: OpenBao is test-only dev/CI, never shipped — Vault stays the flagship external backend) | Accepted (design-only; D5 amended 2026-07-04) | 2026-06-22 |
| ADR-032 | URL secret references + multi-provider routing (vault:///openbao:///authref:///builtin:///… resolved per-resource by RoutingSecretProvider) | Accepted | 2026-06-22 |
| ADR-033 | Unified registry access (stella+oci:// masked refs; digest is identity; loopback agent-registry pull-through) | Accepted | 2026-06-22 |
| ADR-034 | Stella-native short-lived, deployment-scoped secret-access broker (no standing agent token; sealed capability over mTLS) | Accepted | 2026-06-23 |
| ADR-035 | Digest-centric content broker (no standing edge secret; content-addressed authorization; agent fetches by digest over mTLS) | Accepted | 2026-06-24 |
| ADR-036 | Local RFC 3161 Timestamp Authority for the air-gapped evidence spine | Accepted | 2026-07-05 |
| ADR-037 | SM Remote SM4 symmetric mode: ECB deprecation, IV transport, and vendor-contract versioning | Proposed (DRAFT — awaiting crypto + product sign-off) | 2026-07-12 |
| ADR-038 | Evidence artifact nomenclature: Decision Capsule vs Evidence Pack vs Evidence Bundle | Accepted | 2026-07-20 |
| ADR-039 | Database-per-service ownership + consolidated StellaOps.Vulnerabilities hub (one service/one DB, tenant-free, fresh rebuild, no snapshot; connector tiering with Cisco/MSRC/GHSA/KEV/ACSC/CERT-In removed; gates→Policy; tenancy→Authority; doctor→plugins; estate consolidation program + anti-bloat rules) (VDPS-D1…D14) | Proposed (rev-3, awaiting Phase-A approval) | 2026-07-22 |
⚠️ Number collision (needs reconciliation): two accepted ADRs currently claim ADR-013 —
ADR-013-findings-runtime-disabled-mode.mdandADR-013-dotnet-callgraph-extractor-dual-mode.md. ADR numbering must be monotonic and never reused, so one of these should be renumbered to the next free slot (ADR-026 — ADR-025 is now taken by operator-signed decisions). Both are listed above so navigation is not broken; the renumber is a follow-up.