Decisions

A decision that binds future work gets a record, an ADR (architecture decision record): its context, the decision with its reasons, what was rejected and what is not covered. There are sixty-four of them, which is more than anyone reads at once. The records below carry the project. Read them in this order.

Record and the question it answers	Look for
ADR-0001 BFF pattern Why does the browser never hold a token?	The two options it rejects. It is the oldest of these records, and its last consequences lead to ADR-0018, which removed CORS, and ADR-0055, which makes the BFF the API's only client.
ADR-0009 Idempotent monetary operations How is a payment applied once across retries, crashes and duplicates?	Why a key's row has three states and every write to it carries the claim's own id, and why two states with delete-on-error were rejected.
ADR-0022 Client money-mutation protocol When does the client keep an idempotency key, and when does it drop it?	The keep list and the drop list.
ADR-0042 A transfer authorisation is bound and spent once What does one PIN entry prove?	What it opens with: before this decision one static PIN authorised a transfer of 10 and then one of 20.
ADR-0044 The audit trail is append-only and chained What is recorded, and what can the record not detect?	A failed audit write fails the action it describes.
ADR-0053 The committed contract is what the API generates Is the published contract true?	Three claims, and which one the test proves.
ADR-0029 One suite, two backends How is a mock that lies caught?	Decision 3: every expected value is measured on the real stack. Every drift the gate found was fixed in the mock, and the backend was right each time.
ADR-0032 The real-stack layers in CI What runs against the real backend on every pull request?	One job that owns its SQL Server, its API and its BFF.
ADR-0061 Azure, with no database password How is the demo deployed?	Managed identities in place of a password, and the options it rejects.
ADR-0062 Demo visitors get private copies How does each visitor get a demo of their own?	The copy is the unit: it is seeded, claimed and deleted as one. ADR-0063 adds how a visitor claims one.

How to read a record

• Every record has the status Accepted. Two of them, ADR-0021 and ADR-0034, are superseded in part by ADR-0057, and their lines in the index say so.
• A record says what is true now. When a decision changes, its text is rewritten and its Status line gains the date; the earlier wording is in the git history.
• The index names four records to start with. The table above has all of them but ADR-0019, the contract the frontend is written against.

More

• All the records, grouped by theme: By theme.
• What I understood well enough to build and chose not to: Deferred.
• Next page: Tests and CI.