Decisions

Architecture decision records for the demarkus core, for maintainers and agents finding what was settled and where the canonical copy lives.

Part of the demarkus-soul hub. Canonical here since 2026-09-28; docs/adr/ in git is a frozen archive of 0001 to 0027 (see where decisions live). Sub-project decisions live in their own series, for example /demarkus-library/adr/. Status, dates and supersession live in each ADR.

• Decisions 0001 to 0020: the first twenty, from the broker web-client registry to the reconcile owner

• ADR 0021: world registry announces drops, DNS label world names, one tenant door

• ADR 0022: the MCP gateway takes its dependencies from Run, not the Server

• ADR 0023: the broker is core, oauthsrv, gateway and storage behind one Run

• ADR 0024: plugin binary packages by concern, a harness is a host.Host value

• ADR 0025: WATCH is the eighth verb, the store emits hints only, protocol 1.0 freezes after it

• ADR 0026: a client SDK under MIT with its own semver, the server never imports it

• ADR 0027: world token files are optional at open and split into runtime and static files

• ADR 0028: every store owns a durable change epoch and sequence behind backend.ChangeSource

• ADR 0029: the broker issues the federation agent's hub token from agentTokens

• ADR 0030: the broker generates and persists its state cookie key

• ADR 0031: the bucket store seals receipts into change blocks the hub reads as a backlog

• ADR 0032: the knowledge and memory brokers run inside the knowledge server process

• ADR 0033: the knowledge server's bearer listener takes an identity bearer in the auth field

• ADR 0034: the knowledge server derives the federation graph in process into the hub's checkpoints

• ADR 0035: drop content-addressed fetch and the hash index tools before protocol 1.0

• ADR 0036: the bucket store commits through create-only log slots with group commit

• ADR 0037: the contract is the protocol, transports are bindings, two doors by credential kind

• ADR 0038: a broker write carries the verified email as user and the MCP client name as agent

• ADR 0039: drop the standalone federation agent before 1.0; the knowledge server is the only graph producer

• ADR 0040: memory mechanics (gate, doctor, journal, context, curate, promote staging) live in the server; skills keep intent and the gate

• ADR 0041: the knowledge gateway serves the hub's four branding documents without a bearer, so the library brands a cold pod and its sign-in page

• ADR 0042: soul entries are agent-written; software supplies facts, never entries

• ADR 0043: the memory model lives in client/memory/, a directory of the client module, not its own module

• ADR 0044: client/mdoutline splits into protocol/mdoutline, the model's client/memory/outline and marktools

• ADR 0045: write gates (secrets, personal data, policy) run in the store in both tiers, warns reach the writer under a reserved warning key, the hook mirrors the scan pre-write

• ADR 0046: the near-duplicate gate refuses in the store by default, near-duplicate-override keeps both, warn and off are operator modes, no client pre-asks