Architecture decision records
Decisions that constrain the record format, the CLI verbs, and what the docs are allowed to claim. An ADR records what was decided when; later renames are noted in place rather than silently rewritten.
An accepted ADR is a decision, not a ship receipt. Several below are
written in the present tense and describe behaviour that does not exist
yet; “lands in AILAB-*” means the work is ticketed, nothing more. Check
the code or the git tag, not the Status line. The Shipped? column
below answers for current main — the published 0.3.0 binary is a
narrower surface still (CLI).
| ADR | Title | Shipped? |
|---|---|---|
| 0001 | Agent Action Records split into a signed Chain and an optional Envelope | partial — Chain ships; no Envelope store or I/O |
| 0002 | aegis verify reports coverage, not pass/fail | yes |
| 0003 | JCS JSON is the canonical form, over a constrained value space | yes |
| 0004 | The signing key is embedded, and aegis verify labels its trust level | yes |
| 0005 | Approval parks the MCP request, not the audit record | partial — record half ships; no interposer park, no production caller |
| 0006 | Argument matchers target derived capability parameters, not raw JSON | no |
| 0007 | Confinement applies via a self-restricting re-exec, and needs no unsafe | no |
| 0008 | D2’s re-evaluation command is aegis recheck, not aegis replay | yes |
| 0009 | D4 reproduces a cross-boundary exfiltration chain, not a same-server one | no — demo not built |
| 0010 | macOS confinement fast-follows M4; it does not gate it | no |
| 0011 | The workspace and the spec are dual Apache-2.0 OR MIT; this supersedes OQ-1 | yes — crates.io 0.3.0 metadata stays MIT |
| 0012 | The audit sink is a public seam that declares its own retention | yes |
| 0013 | Verify and Recheck share a line classifier, not a walk | yes |
| 0014 | The record file extension is .aarl | yes — every example writes it; no code parses an extension, by design |
| 0015 | Wrap may synthesize a JSON-RPC error for an opted-in enforcement refusal | partial — --policy refuses and the real hash is recorded; no approval park |
The bold no rows carry an above-the-fold Not implemented banner on the ADR itself. They are kept here, unedited, because an ADR is a record of a decision — not a page that gets quietly revised once reality disagrees with it.
ADR-0001 says aegis replay throughout. That command was renamed the
same day by ADR-0008. Read every replay in 0001 as recheck. Left
unedited because an ADR records what was decided when.
ADR-0008 writes session.<ext> three times. The extension was genuinely
open when 0008 was written, and 0008 says so in the same sentence that
rules .aar out. ADR-0014 later fixed it as .aarl. Read every
session.<ext> in 0008 as session.aarl. Left unedited for the same
reason as 0001.
ADR-0006 decides that argument matchers target derived capability
parameters, and its status line says it lands in AILAB-626. It does
not: that work was canceled in AILAB-626 on 2026-08-14 and will not be
built, so the no in the table above is permanent rather than pending.
The derived parameters themselves did ship — they are the decision_axes
a Chain Line carries — and only the matchers that would have consumed
them were dropped. Left unedited for the same reason as 0001.