BSFG architecture decisions are documented as ADRs following Michael Nygard's template. Each ADR captures the context, decision, and consequences of significant architectural choices.
- ADR-0001 — Boundary Must Contain No Durable Middleware
- ADR-0002 — Four-Buffer Topology Is the Minimal Partition-Tolerant Boundary
- ADR-0003 — Idempotency Is Enforced at the Storage Interface
- ADR-0004 — Contiguous Frontier Determines Safe Truncation
- ADR-0005 — Three-Log Topology Emerges in Large Deployments
- ADR-0006 — Boundary Communication Is Asynchronous Replay
- ADR-0007 — Boundary Fact Transport Is Log-Centric
- ADR-0008 — Semantic Unit Is Envelope Plus Fact
- ADR-0009 — Each Zone Owns Its Local Log Domain
- ADR-0010 — Boundary API Uses Connect RPC
- ADR-0011 — Boundary Identity Uses Mutual TLS
- ADR-0012 — Append Is Idempotent and Confirmation Means Durable Commit
- ADR-0013 — Large Artifacts Are Stored Out-of-Band and Referenced by Facts
- ADR-0014 — Facts Are Append-Only and Retention Is Time-Based
- ADR-0015 — Stream Topology Is Small Fixed Sets with Subject-Prefix Partitioning
- ADR-0016 — Subject Identity Uses Kind With Optional Scope
- ADR-0017 — Object Payload Uses Canonical JSON with Optional Schema Reference
- ADR-0018 — Operational Visibility Uses Metrics and Structured Logs
- ADR-0019 — Fetch Uses Unary Paged Pull
- ADR-0020 — Envelope Carries Boundary Metadata and Policy Labels
- ADR-0021 — Predicate Vocabulary Uses Stable Relation Names
- ADR-0022 — Boundary Contract Is Four Explicit RPC Operations
- ADR-0023 — Fetch Progress Uses Durable Named Consumers
- ADR-0024 — Artifact Upload and Fact Append Remain Separate Core Operations
- ADR-0025 — Zone Names Are Deployment Configuration, Not Protocol Enums
- ADR-0026 — Business Acceptance Is Modeled Downstream, Not In Boundary Confirmation
- ADR-0027 — Authoritative Boundary Truth Is Fact History, Not Mutable State
- ADR-0028 — Business Schema Validation Is Outside the Boundary Substrate
- ADR-0029 — Cross-Zone Synchronization Uses BSFG Peer Protocol, Not Native Stream Mirroring
- ADR-0030 — Durable Consumers Are Named Infrastructure, Not Ephemeral Session State
- ADR-0031 — Clients Access Boundary Storage Only Through BSFG Service
- ADR-0032 — Cross-Zone Transfer Is Pull-Driven by the Receiving Zone
- ADR-0033 — Boundary Delivery Semantics Are At-Least-Once with Idempotent Append
- ADR-0034 — NATS Accounts Are Zone-Scoped, Not Globally Shared
- ADR-0035 — Message Lineage Uses Correlation and Causation in the Envelope
- ADR-0036 — Canonical JSON Serialization for Object Payloads
- ADR-0037 — Envelope Metadata Is System-Level; Fact Body Is Domain-Level
- ADR-0038 — Ordering Is Local and Explicit, Not Global Across Zones
- ADR-0039 — Referenced Artifacts Become Immutable Once Fact-Addressed
- ADR-0042 — Four-Buffer Entities Are Boundary Roles Implemented by BSFG Nodes
- ADR-0043 — Producer and Consumer Integration Contract