Architecture Decision Records

ADRs record decisions that constrain Komms across implementations. An accepted ADR is normative until another ADR explicitly supersedes it. A proposed ADR is design work under review: it may guide experiments, but it is not a stable product promise merely because the file exists.

ADR	Status	Decision area
0001	Accepted	Rust core and crate boundaries
0002	Accepted	XChaCha20-Poly1305 for AEAD
0003	Accepted	Double Ratchet with hybrid PQXDH
0004	Accepted	libp2p internet transport
0005	Accepted	Meshtastic-first off-grid transport
0006	Accepted	AGPLv3 licensing
0007	Accepted	Recipient-scoped delivery tokens
0008	Accepted	In-tree hardened mDNS
0009	Accepted	Token-blind internet↔mesh bridging
0010	Accepted	UniFFI embedded runtime
0011	Accepted	Mnemonic-sealed backup
0012	Accepted	Sender-key group messaging
0013	Accepted; Beta audio implemented	Direct-QUIC real-time call transport and gating
0014	Accepted	Versioned encrypted message content
0015	Proposed; implementation exists	Encrypted attachment pipeline and no-airtime policy
0016	Accepted	Canonical group-mention content
0017	Accepted; operating modes implemented for Beta	Optional service modes and trust boundary
0018	Accepted; implemented for Beta	Rotating pairwise rendezvous
0019	Accepted; gateway, core, and mobile clients implemented for Beta	Capability-gated native wake
0020	Accepted	Immutable edit events, pairwise/group authorization, and deterministic convergence
0021	Accepted	Authenticated local expiry, view-once consumption, and coarse relay retention
0022	Accepted	Visible-vote group polls, recipient-authenticated voters, and deterministic convergence
0023	Accepted	Owner-serialized roles, signed generation-bound admin requests, and authority transfer
0024	Accepted Alpha; security-limited	Confirmed linking, per-device cryptography, sync, exact-id exclusion, and recovery; permanent-revocation claim withdrawn
0025	Proposed	Optional epoch-scoped Freenet store-and-forward carrier and metadata boundary
0026	Accepted; implemented for Beta	Offline account-root recovery, strict-majority device manifests, visible conflicts, honest copied-root reset, and root-free KKR8–KKR10
0027	Accepted; implemented	Versioned keyed indexes, row-bound sealing, transactional migration, and honest local deletion limits
0028	Proposed; stable-profile inventory implemented with open boundaries	Transactional ratchet, handshake, group-chain, queue, replay, attachment, maintenance, and deferred-inbox state transitions
0029	Accepted; implemented for Beta	Per-recipient origin authentication for sender-key group messages and author-sensitive state
0030	Accepted; implemented for Beta	Bounded public introductions, provisional message requests, blocking, and group-invite consent
0031	Accepted; implemented for Beta	Capability-scoped, encrypted DHT first contact with mailbox-only public routes
0032	Accepted; implemented for Beta	Durable deposits, leased collection pages, and acknowledgement-after-endpoint-commit
0033	Accepted	Nonprofit public-benefit mission, founder-directed incubation, AGPL reciprocity limits, and adoption-triggered governance evolution
0034	Accepted; reference service implemented for Beta; deployment gate open	RAM-backed, content-blind, replaceable reference bootstrap/DHT/rendezvous deployment with explicit operator limits
0035	Accepted; conformance kit implemented; independent execution gate open	Stand-alone stable-v1 wire/state specification, versioned fixtures, compatibility policy, and honest conformance evidence

The attachment implementation follows ADR-0015 and its hard no-airtime rule, but the ADR file still carries Proposed status. This index reports that governance state rather than silently treating implementation as acceptance.

Use the template for a new decision. Protocol, cryptographic, transport, replicated-state, or persisted-format changes require an ADR before implementation; ordinary local UI work does not.

Return to Start Here, the Architecture, or the Feature Delivery Plan.