# Architectural decisions

Read the original decisions, their constraints and their recorded evidence.

The pages below render the Markdown files in `docs/adr` directly. The decision records are the source of truth; feature guides explain how to work within them.

Each record starts with a status line: the status, the date it was accepted and, where it applies, the record that amends or supersedes it. An accepted decision changes only through a new record or a dated clarification.

| ADR | Decision | Status |
| --- | --- | --- |
| [0001](/docs/adr/0001-stored-file-keys-keep-the-user-s-filename) | Stored file keys keep the user's filename | accepted · 2026-07-13 |
| [0002](/docs/adr/0002-no-barrels-on-server-capable-modules) | Server-capable modules have no barrel | accepted · 2026-07-30 |
| [0003](/docs/adr/0003-organizations-are-the-tenant) | Organizations are the tenant | accepted · 2026-09-17 |
| [0004](/docs/adr/0004-payments-providers) | Payments: one entitlement read model, three provider modules | accepted · 2026-10-12 |
| [0005](/docs/adr/0005-effect-boundary) | Effect stays at the server edges | accepted · 2026-10-12 · amended by 0010 |
| [0006](/docs/adr/0006-effect-persisted-queue) | Todo imports and the PersistedQueue gate | accepted · 2026-10-13 |
| [0007](/docs/adr/0007-ai-assistant-and-tool-catalog) | AI assistant and one tool catalog | accepted · 2026-10-14 |
| [0008](/docs/adr/0008-documents-and-large-uploads) | Documents and direct uploads | accepted · 2026-10-15 |
| [0009](/docs/adr/0009-row-level-security) | Row-level security isolates Organizations | accepted · 2026-10-16 |
| [0010](/docs/adr/0010-procedures-run-one-effect-program) | Procedures run one Effect program at their edge | accepted · 2026-10-17 · amends 0005 |
| [0011](/docs/adr/0011-backend-feature-shape) | Backend features have a fixed file shape | accepted · 2026-10-17 |