# Architectural decisions

Read the original decisions, their constraints and their recorded evidence.

The pages below render the Markdown files in `docs/adr` directly. The decision records are the source of truth; feature guides explain how to work within them.

Each record starts with a status line: the status, the date it was accepted and, where it applies, the record that amends or supersedes it. An accepted decision changes only through a new record or a dated clarification.

| ADR                                                              | Decision                                                     | Status                                  |
| ---------------------------------------------------------------- | ------------------------------------------------------------ | --------------------------------------- |
| [0001](/docs/adr/0001-stored-file-keys-keep-the-user-s-filename) | Stored file keys keep the user's filename                    | accepted · 2026-07-13                   |
| [0002](/docs/adr/0002-no-barrels-on-server-capable-modules)      | Server-capable modules have no barrel                        | accepted · 2026-07-30                   |
| [0003](/docs/adr/0003-organizations-are-the-tenant)              | Organizations are the tenant                                 | accepted · 2026-09-17                   |
| [0004](/docs/adr/0004-payments-providers)                        | Payments: one entitlement read model, three provider modules | accepted · 2026-10-12                   |
| [0005](/docs/adr/0005-effect-boundary)                           | Effect stays at the server edges                             | accepted · 2026-10-12 · amended by 0010 |
| [0006](/docs/adr/0006-effect-persisted-queue)                    | Todo imports and the PersistedQueue gate                     | accepted · 2026-10-13                   |
| [0007](/docs/adr/0007-ai-assistant-and-tool-catalog)             | AI assistant and one tool catalog                            | accepted · 2026-10-14                   |
| [0008](/docs/adr/0008-documents-and-large-uploads)               | Documents and direct uploads                                 | accepted · 2026-10-15                   |
| [0009](/docs/adr/0009-row-level-security)                        | Row-level security isolates Organizations                    | accepted · 2026-10-16                   |
| [0010](/docs/adr/0010-procedures-run-one-effect-program)         | Procedures run one Effect program at their edge              | accepted · 2026-10-17 · amends 0005     |
| [0011](/docs/adr/0011-backend-feature-shape)                     | Backend features have a fixed file shape                     | accepted · 2026-10-17 · amended by 0013 |
| [0012](/docs/adr/0012-web-features-mirror-the-backend-shape)     | Web features mirror the backend shape                        | accepted · 2026-10-17                   |
| [0013](/docs/adr/0013-mobile-features-mirror-the-backend-shape)  | Mobile features mirror the backend shape                     | accepted · 2026-10-17 · amends 0011     |
| [0014](/docs/adr/0014-health-data-tenancy-and-global-catalogs)   | Health data tenancy and global reference catalogs            | accepted · 2026-10-20                   |