https://adr.stephens.page/https://adr.stephens.page/about/https://adr.stephens.page/decisions/0001-docker-over-bare-metal-for-tenant-isolation/https://adr.stephens.page/decisions/0002-external-managed-db-over-containerized/https://adr.stephens.page/decisions/0003-periodic-snapshot-over-live-replication/https://adr.stephens.page/decisions/0004-shell-deploy-over-hosted-ci-runner/https://adr.stephens.page/decisions/0005-scoped-system-user-over-service-account/https://adr.stephens.page/decisions/0006-binlog-daemons-over-database-triggers/https://adr.stephens.page/decisions/0007-pull-probes-over-push-agents/https://adr.stephens.page/decisions/0008-embedded-sqlite-over-networked-db-for-tooling/https://adr.stephens.page/decisions/0009-default-deny-host-pinned-db-access/https://adr.stephens.page/decisions/0010-pixel-equality-gate-over-diff-review-for-generated-markup/https://adr.stephens.page/decisions/0011-instrumented-metrics-stack-over-bespoke-prober/https://adr.stephens.page/decisions/0012-copy-deployed-sync-services-over-shared-multi-tenant-backend/https://adr.stephens.page/decisions/0014-import-live-dns-over-recreating-it/https://adr.stephens.page/decisions/0015-state-off-the-provider-it-provisions/https://adr.stephens.page/decisions/0017-self-hosted-signing-instrument-over-saas/https://adr.stephens.page/decisions/0018-runtime-injected-secrets-over-plaintext-config/https://adr.stephens.page/decisions/0019-reuse-passkey-session-forward-auth-over-second-auth-stack/https://adr.stephens.page/decisions/0020-private-mesh-for-shells-mfa-gated-public-endpoints-for-browsers/https://adr.stephens.page/decisions/0021-shared-collector-seam-over-direct-backend-wiring/https://adr.stephens.page/decisions/0022-colocated-loki-behind-collector-seam-over-dedicated-log-stack/https://adr.stephens.page/decisions/0027-pin-and-prove-unsigned-dependencies-keyed-to-the-pin/https://adr.stephens.page/decisions/0028-per-consumer-secret-manifests-and-validate-every-manifest-read/https://adr.stephens.page/decisions/0029-pin-the-serving-checkout-fast-forward-only-edit-in-worktrees/https://adr.stephens.page/decisions/0030-immutable-releases-atomic-promotion-append-only-journal/https://adr.stephens.page/decisions/0031-ci-deploy-key-restricted-to-one-forced-command-over-host-pull/https://adr.stephens.page/decisions/0032-dedicated-host-for-unauthenticated-ingestion-store-private-by-construction/https://adr.stephens.page/decisions/0033-grow-the-disk-and-cap-retention-by-size/https://adr.stephens.page/decisions/0034-root-allowlist-with-404-over-blocklist-with-403-for-a-legacy-webroot/https://adr.stephens.page/decisions/0040-serial-subagent-rounds-over-detached-parallel-processes/https://adr.stephens.page/decisions/0041-one-primary-agent-file-byte-identical-shared-layer-per-host-facts/https://adr.stephens.page/decisions/0042-read-the-union-view-inline-it-for-aggregates-lint-the-shape/https://adr.stephens.page/decisions/0043-audit-history-never-retains-secret-values-retroactively/https://adr.stephens.page/decisions/0044-additive-fail-closed-section-permissions/https://adr.stephens.page/decisions/0046-preview-containment-in-the-application-proved-by-egress-test/https://adr.stephens.page/decisions/0047-scripts-hide-rows-and-derive-no-figures/https://adr.stephens.page/decisions/0048-static-musl-release-binaries-with-a-ci-guard/https://adr.stephens.page/decisions/0049-expand-contract-entitlements-old-endpoint-kept-reads-fail-open/https://adr.stephens.page/decisions/0050-one-conformance-corpus-over-three-hand-written-engines/https://adr.stephens.page/decisions/0051-repeatable-llm-judge-over-accurate-one-when-the-verdict-is-cached/https://adr.stephens.page/decisions/0053-a-review-finding-carries-a-failing-test-and-a-decline-cites-the-run/https://adr.stephens.page/decisions/0054-merge-the-exact-head-whose-ci-was-watched-over-platform-auto-merge/https://adr.stephens.page/decisions/0055-decide-ci-outcomes-from-structured-state-not-the-agents-account/https://adr.stephens.page/decisions/0056-a-features-tickets-merge-into-one-branch-so-review-happens-once/https://adr.stephens.page/decisions/0057-a-sandbox-reads-the-primary-not-a-replica-that-can-stall-silently/https://adr.stephens.page/decisions/0058-the-hosted-runner-asks-and-the-host-decides/https://adr.stephens.page/decisions/0059-two-processes-one-release-refuse-when-they-disagree/https://adr.stephens.page/decisions/0060-a-failed-deploy-pauses-nothing-and-recovery-reads-production/https://adr.stephens.page/decisions/0061-release-the-session-lock-before-slow-work/https://adr.stephens.page/decisions/0062-tests-refuse-the-production-schema-and-a-wiring-check-enforces-it/https://adr.stephens.page/decisions/0063-watch-the-work-not-the-process-with-a-window-longer-than-the-stall/https://adr.stephens.page/decisions/0064-authority-over-a-shared-record-follows-the-person-it-is-about/https://adr.stephens.page/decisions/0065-assert-enforcement-at-the-script-the-workflow-and-the-ruleset/https://adr.stephens.page/case-study/https://adr.stephens.page/threat-model/https://adr.stephens.page/checklist/https://adr.stephens.page/observability/