§7 Architecture decisions
| ADR | Subject | Status | Class of what it decides | Record-level impact of the decision |
|---|---|---|---|---|
| ADR-0001 | Two-plane versioning | Accepted | editorial (policy) | None. Explains why 1.0.1 Records still declare ver_version: "1.0" |
| ADR-0002 | 1.0.1 delta scope | Accepted | patch-compatible correction (policy) | None directly; it is the reason several patch-correction findings were deferred to 1.1 rather than shipped as schema changes |
| ADR-0003 | Validator strictness and code stability | Accepted | patch-compatible correction (policy) | None. Five codes (four rules) exceed VER 1.0 and are labelled as such; a producer failing only those is schema-conformant. The count is stated once, in `docs/standards/VER-1.0-errata.md` §6 |
| ADR-0004 | Provenance action extensibility | Accepted — conditionally | additive 1.1 | Accepted subject to five conditions (C1–C5): a governed registry must exist; conformance binds to a registry snapshot (provenance.registry); the core/registered/opaque tiers and old-consumer behaviour are stated; target separates asset events from Record events; sign requires provenance.signature and publish should carry its uri. C4 and C5 are in the draft schema; C1–C3 were checklist row 8, and standards/registry/ discharges it |
| ADR-0005 | Lineage representation | Accepted — model adopted, shape revised | additive 1.1 | The parent reference is reshaped: at least one globally resolvable identifier (record_uri, or {producer_id, record_id}), a bare record_id no longer qualifying (E16), pixel_hash as {value, cpnp_version} and never qualifying (E27), recipe_uri ⇒ recipe_sha256, and a specified recipe envelope. Eight semantic fixtures are a ratification condition, and conformance/ now carries all eight (checklist row 11) |
| ADR-0006 | Is redactions[].salted_sha256 mandatory? | Accepted — revised Option A, version-gated | additive 1.1 (rename + version-gated requirement) | Decided. For 1.1 Records a producer_performed redaction REQUIRES a commitment; the never-held case gets its own state (upstream_withheld) and its own availability state; the member is renamed commitment_sha256 with commitment_alg, and its preimage changes, so a 1.0.x value must be recomputed. 1.0.x is untouched and VER1002 stays a warning there. This was the standards track's only open decision |
| ADR-0007 | Model-bundle manifest hashing | Accepted — principle adopted, construction revised | additive 1.1 | weights_sha256 is not redefined and keeps E29's reading forever; the 1.1 pin is model.bundle.manifest_sha256 under bundle_digest_alg. Path grammar hardened, model.artifacts[] added, checkpoint_uri ⇒ revision |
| ADR-0008 | embedding.dim/dtype mandatory in 1.1 | Accepted as written | additive 1.1 (conditional tightening) | Required only for ver_version: "1.1" Records; making it unconditional would invalidate 1.0 Records and is a 2.0 change. Acceptance also encodes the binary dtype's rules in the schema. Its fixture and byte-order conditions are checklist row 11, now met for everything a record fixture can express: exactly-one-carriage and binary-inline have fixtures of their own, while byte order and dtype-aware encoding are producer-side encoder properties no Record can state, so the corpus pins their observable consequence — decoded vector byte length (VER604, annex E24) |
Ratification exposure. All eight ADRs are now Accepted — three of them (0004, 0005, 0007) with revisions that are in the 1.1 artifacts, and ADR-0006 decided outright. The standards track has no open decisions.
What that does not mean is that 1.1 is ratifiable. ADR-0004's conditions are now met, and so are ADR-0005's and ADR-0008's fixture conditions — but of the ten deliverable and evidence rows in standards/ver/1.1-draft/RELEASE.md, five remain: reference-set manifests exist with no descriptor citing one; the wire lexicon exists with no reference implementation resolved against it; the size corpus is this project's own and not a deployment's; and two of the five have not started at all — a second independent implementation, and an external review period. Reversing any of the five 1.1 ADRs still edits only the draft and never a published artifact.