Decision Records

Generated from docs/adr/README.md in the repository. Edit it there; this wiki is rebuilt on every change.

Architecture Decision Records

Short records of the significant choices in EdgeShell and why they were made.

ADR	Decision
0001	Flask app-factory pattern
0002	SQLite WAL by default, export/import to any SQL
0003	CSRF on, fail hard on missing production secrets
0004	Central role-based access control
0005	VPN behind an interface (Tailscale now, WireGuard later)
0006	Ansible with real per-host results for fleet ops
0007	Manifest-based update and rollback
0008	Hot database plus a replicated, read-only data lake that the app cannot erase
0009	Public API: per-user credentials, least privilege, administrator control and audit
0010	Fleet safety guards: paused logins, command policy, explicit bulk actions
0011	CI as the release gate, with minimum counts and real dependencies
0012	Security model: the CIA triad for a central fleet control plane
0013	A second, VPN-independent liveness signal: encrypted MQTT heartbeats
0014	Node-RED and the remote desktop through EdgeShell at /nodered// and /remoteGUI//, isolated on the same origin
0015	Hardware lifecycle: nodes as positions, detected replacements, fault reports
0016	The heartbeat agent on every node, kept there by a routine; four ways to the broker
0017	Apps on the edge: one folder, one service, versions side by side, a way back
0018	The heartbeat agent is an app: its own venv, an atomic switch, a way back, moved over from the classic install