# Decisions

Part of the [demarkus-soul hub](/index.md). Architecture decision records for the core project, canonical here since 2026-09-28; `docs/adr/` in git is a frozen archive of 0001 to 0027 (see [where decisions live](/conventions.md#where-architectural-decisions-live)). Sub-project decisions live in their own series, for example [/demarkus-library/adr/](/demarkus-library/adr/). Status and dates live in each ADR.

- [ADR 0001](/adr/0001-broker-confidential-web-clients.md): broker confidential web-client registry
- [ADR 0002](/adr/0002-okf-metadata-alignment.md): align store frontmatter with the Open Knowledge Format
- [ADR 0003](/adr/0003-okf-type-default-on-publish.md): default OKF `type` on publish
- [ADR 0004](/adr/0004-edge-semantics-rel-convention.md): edge semantics, provenance on every edge, typed relations via `rel-` metadata
- [ADR 0005](/adr/0005-node-identity-default-port.md): node identity omits the default port
- [ADR 0006](/adr/0006-postgres-backend-is-an-optional-build.md): the Postgres backend is an optional build, not a dependency; superseded by [ADR 0010](/adr/0010-remove-postgres-backend.md)
- [ADR 0007](/adr/0007-sni-virtual-world-routing.md): SNI selects and pins one virtual Mark server per QUIC connection
- [ADR 0008](/adr/0008-gcs-root-cas-storage.md): GCS world state commits through one root CAS
- [ADR 0009](/adr/0009-license-split-core-agpl-plugins-mit.md): AGPL for the core, MIT for plugins and satellites
- [ADR 0010](/adr/0010-remove-postgres-backend.md): remove the Postgres backend; the knowledge server owns shared multi-writer state
- [ADR 0011](/adr/0011-native-scheme-redirect-allowlist.md): allowlisted private-use scheme redirects for MCP hosts, unblocking Cursor's MCP OAuth against the broker
- [ADR 0012](/adr/0012-lookup-body-match.md): body match is an optional mode of LOOKUP; recall specified, ranking left to the implementation

- [ADR 0013](/adr/0013-graph-source-freshness.md): source revisions, extraction views, graph freshness and generated-format compatibility
- [ADR 0014](/adr/0014-protocol-module-is-wire-and-stored-format.md): the protocol module is wire and stored format only
- [ADR 0015](/adr/0015-backend-contract-context-and-views.md): the backend contract takes a context per call and reads through views
- [ADR 0016](/adr/0016-write-policy-as-a-commit-precondition.md): the publish policy is enforced above the store, inside its commit
- [ADR 0017](/adr/0017-archive-precondition-closed-views-and-seeding.md): archive preconditions, closed views, and seeding above the store
- [ADR 0018](/adr/0018-one-mark-url-parser-and-lowercase-host-identity.md): one mark URL parser, and host case is not identity
- [ADR 0019](/adr/0019-shared-tool-bodies-and-one-write-contract.md): tool bodies and the write contract live in shared packages
- [ADR 0020](/adr/0020-one-reconcile-owner-and-check-order.md): one reconcile owner in `docwrite`, and write tools check arguments before authorization
- [ADR 0021](/adr/0021-world-registry-names-and-one-tenant-door.md): a world registry that announces drops, DNS label world names, one tenant door for tools and resources
- [ADR 0022](/adr/0022-gateway-dependencies-not-the-server.md): the MCP gateway takes its dependencies from `Run`, not the Server; `NewServer` takes a deps struct
- [ADR 0023](/adr/0023-broker-packages-behind-one-run.md): the broker is `core`, `oauthsrv`, `gateway` and `storage` behind one `Run`, with `brokertest` for shared fixtures
- [ADR 0024](/adr/0024-plugin-binary-packages-by-concern-and-host-values.md): the plugin binary is `provision` and `registry` package families by concern, and a harness is a `host.Host` value
- [ADR 0025](/adr/0025-watch-verb.md): WATCH is the eighth verb, the store emits hints only, and protocol 1.0 freezes after WATCH and ALPN `mark/1`
- [ADR 0026](/adr/0026-client-sdk-mit-server-never-imports.md): a client SDK under MIT with its own semver, CC0 wire fixtures, the server never imports it, exact relicensed file list
- [ADR 0027](/adr/0027-world-token-files-optional-and-split.md): world token files are optional at open and split into a broker-owned runtime file and an operator-owned static file; the chart's bootstrap Job becomes optional for GitOps
- [ADR 0028](/adr/0028-stores-own-a-durable-change-sequence.md): every store owns a durable change epoch and sequence behind `backend.ChangeSource`, proven by one conformance suite; the file store keeps a journal
- [ADR 0029](/adr/0029-broker-issues-agent-hub-tokens.md): the broker issues the federation agent's hub token from `agentTokens`, with a broker record as the ownership marker; the umbrella drops the bootstrap Job (proposed)
- [ADR 0030](/adr/0030-broker-generates-its-cookie-key.md): the broker generates and persists its state cookie key, so the chart render is deterministic under Argo CD (proposed)
- [ADR 0031](/adr/0031-bucket-store-seals-change-blocks.md): the bucket store seals receipts into change blocks outside the commit, and the hub reads them as a cached backlog, so a knowledge cursor resumes across a restart up to the ring
- [ADR 0032](/adr/0032-broker-in-the-knowledge-server-process.md): the knowledge and memory brokers run inside the knowledge server process as two gateways on one mux; in-process dispatch, no write token handoff, WATCH fan-out on the hub, resource bound tokens (proposed)