ADR-NNNN: Decision title

Status: Proposed | Accepted | Superseded by ADR-NNNN (link it once it exists) Date: YYYY-MM-DD Issue/PR: #NNNN (if applicable)

Context

What is the problem or forcing function? What constraints (technical, product, team) shaped the options? Link to the design docs in docs/ that motivated this rather than re-deriving them here.

Decision

The choice made, stated plainly in one or two sentences. Not a survey of options — the actual call.

Consequences

What this buys us, and what it costs. Include the things that get harder, not just the things that get easier — an ADR that only lists upsides wasn't honestly argued.

Alternatives considered

• Option A — why it was rejected.
• Option B — why it was rejected.

Revisit when

The condition under which this decision should be reopened (a scale threshold, a new requirement, an upstream change). If there's no realistic condition, say "no planned revisit."

Security consequences

Which trust boundary, attacker capability, secret, tenant invariant, evidence guarantee, fail-closed path, or operational risk changes? State required security review and residual risk.

Verification

List the exact commands, tests, metrics, failure exercises, or production evidence that demonstrate the decision works. Mark pseudocode as such.

References

Link the owning architecture, component, flow, runbook, implementation status, issue, and superseded/superseding ADRs.