Architectural decisions

The decisions that set the direction of the architecture. Each is stated once, in its own file by number, with its reason and a link to the design document that holds the detail. Other documents cite them as "AD-n". A decision changes by editing its entry, not by contradicting it elsewhere.

	Decision
AD-1	The security principles are normative
AD-2	The director is the only writer to the deployment repository
AD-3	The store's data lives outside the cluster; its interface is an app on it
AD-4	One catalog kind, ComponentProfile, with classes
AD-5	Requirements and integrations are separate fields
AD-6	Exposure carries a mandatory authMode and a surface
AD-7	Namespaces are named by tier
AD-8	Kernel trust domains are separate namespaces
AD-9	System services have no public route
AD-10	The desktop is the desktop, for everyone; the consoles are apps
AD-11	The layout applies to fresh installs
AD-12	The authorization store is a projection; Keycloak's events are the only source of membership
AD-13	The edge is the only session authority
AD-14	Without a store, apps are installed by command only
AD-15	The OS is multi-lingual
AD-16	Every cluster role but admin and breakGlass is held by a person named in git
AD-17	Identity crosses clusters only as a partner link, by standards