Architecture decisions

Modgud records the decisions that shape it, not just their outcome. Each record states what the situation was, what was decided, and what the decision costs — including the ones that were later reversed. A decision record is history; it is not edited to match what we would decide today.

Records are numbered once and never renumbered or reused. A superseded record keeps its number and gains a pointer to the record that replaced it.

The records

#	Decision	Status
0001	OAuth / MCP client registration: DCR now, CIMD next	Accepted
0002	Public origin is derived, not configured	Superseded by 0023
0003	Persistence: hybrid event sourcing + flat documents	Accepted
0004	Tenancy: database per realm, master/system split	Accepted
0005	Permission model: per-app catalog, RBAC via groups, two bypass tiers	Accepted
0006	Identity hub, not federation proxy	Accepted
0007	Access tokens: reference by default, per-client JWT opt-in	Accepted
0008	CIMD — client-ID metadata documents	Accepted
0009	Per-client WebAuthn RP-ID	Accepted
0010	Native cookieless token grants	Accepted
0011	Application tier: a soft facet within a tenant	Accepted
0012	Invite-code-gated passwordless self-registration	Accepted
0013	PageBuilder: named page variants and activation	Accepted
0014	Finish the customization core before the page builder	Accepted
0015	Positions, terminals and staffing are the shared-device model	Accepted
0016	Policy, binding and control-plane semantics for positions	Accepted
0017	Staged configuration (draft mode) with transactional apply	Accepted
0018	Registration before proof	Accepted
0019	Caller context and multi-dimensional rate limiting	Accepted
0020	Device-aware login throttling	Accepted
0021	Back-channel logout	Accepted
0022	Two-instance operation	Accepted
0023	The public origin is declared, not derived	Accepted
0024	A manifest identifies by id, never by name	Accepted
0025	Sign-in assurance is required by the target app, not by the entry URL	Proposed
0026	Test accounts are ordinary accounts with a marker	Proposed