Decision records
September 16, 2026 · View on GitHub
A steering veto list. Open the list below before proposing a new primitive, surface, or storage home. Architecture docs and code describe how the system works today; this folder records product-shaped decisions already made, usually a no with a revisit-if.
Linked from AGENTS.md for that check — not as homework and not as a museum.
A good record is half a page: context, the decision, consequences. See 0025 for the shape that actually steers (write the no before the next agent re-proposes the primitive).
Decision records are point-in-time documents, so they are exempt from
npm run docs:check-temporal; everything else in docs/ describes current
behavior (see documentation principles).
When to add a record
Write one after you have already decided not to build something the next
agent will otherwise re-propose. Copy 0000-template.md
to the next unused number (read this index on main first) with a kebab-case
slug. Keep it to roughly half a page.
Do not write an ADR on every PR. Number collisions (two 0022s, then two
0028s, then two 0029s the same day) are the failure mode of that habit. If a
number collides, renumber the later record; do not leave duplicates.
npm run docs:check-decisions (part of npm run validate) rejects duplicate
primary numbers. A lab note may share a number only as NNNN-*-lab.md.
Do not record layout or UI tweaks, mode assignments, or "we use library X" unless that pick is a no that will otherwise be re-litigated.
When a later record changes a decision, mark the old one superseded by NNNN
rather than editing or deleting it, and list it under
Historical / UI / implementation.
Add new steering records to the steering list, not a catch-all numbered dump.
Steering list
Open these before proposing a new primitive, surface, or storage home.
- 0001 — No user-facing package versioning or import pins
- 0031 —
kody.dependenciesis a name-to-*map; still no pins or live resolution - 0002 — Data placement: D1, per-user Durable Objects, Analytics Engine
- 0003 — Repos are the base primitive; packages are an explicit extension
- 0004 — Status page stays a separate worker with its own storage
- 0005 — Keep the MCP legacy lane until metrics retire it; no Tasks yet
- 0006 — No repo/package CI primitive
- 0007 — Keep in-house feature flags; no package flag primitive
- 0008 — No traces, previews, browser-run, gradual deploys, or session mining
- 0011 — Keep workers-unit per-file isolation; do not warm DOs to "fix" slowness
- 0013 — Post-publish checks stay on MCP; no signed app URLs or inbox injection
- 0036 — Person accounts do not run official platform packages — supersedes 0035 and the remaining execute-live half of 0014; fork, then use the copy
- 0037 — No author-facing
packages.invoke— static import,import(specifier), or workflows; HTTP-token ingress is 0048 - 0048 — Inbound HTTP is webhooks; invocation tokens drain
— no
*webhook URLs; token surfaces unadvertise after the soak; the HTTP token path drains until leftover rows are 0 - 0015 — Wait on Skills over MCP; serve skill content via packages
- 0017 — Hosted package apps use per-user subdomains; same-owner isolation deferred
- 0020 — Repo sessions spill Workspace objects to R2; do not adopt
@cloudflare/computer - 0021 — Publish-gated packages; no in-process composition runtime
- 0022 — Retire the values primitive; do not add a thinner settings twin
- 0023 — Progressive search disclosure; no full-SDK dumps or unbounded listings
- 0024 — Packages outrank synthesized providers; no auto-delete or ranking toggle
- 0025 — No package services primitive
- 0032 — No unattached jobs; schedules belong to packages or workflows
- 0033 — No user-as-conversation, MCP session, or user-global memory hide (lab)
- 0026 — Invocation tokens belong to one package; no account-level wildcard bearer
- 0027 — No invocation-token source allowlist
- 0034 — Origin owns no Durable Object classes
— platform classes live on
kody-platform; do not put them on origin, runtime, or jobs, and do not add a second origin-facing content worker - 0041 — No hardcoded operator correspondence when an admin topic exists
— platform owns the fact and the event; packages own the reaction; no official
@kody/*admin-notify package - 0042 — No capability-input secret placeholders or capability allowlists
— fetch host approval and package grants remain; do not re-add
x-kody-secretinput resolution orallowed_capabilities - 0043 — Repo visibility is the share switch; no community-package kind
— no
package.json#privateSoT, no second publish semantics (communityPublishstays a visibility alias), no license bureau, no trusted listings - 0044 — Retired brand domains stay retired
— do not re-attach
heykody.app,heykody.dev, orkodyapps.devas app, package-app, status, or email hosts - 0045 — Official guides load through search, not execute
—
guide:{id}entity detail is the read path; do not executecodingGuideGetjust to load a guide - 0046 — Community is the catalog; public is the visibility word
— no “community package” kind-name; do not rename
/communityor the MCPcommunitydomain; listing_* identifiers stay until a dual-declare cut - 0047 — One Vectorize index with per-user namespaces until 5,000 users — no sharding or metadata-only filtering before 5k accounts; the shard shape is pre-decided for when it is needed
- 0049 — No MCP capability OAuth scopes
— connecting an agent is one grant;
openid/profile/emailstay identity claims, not a permission menu - 0050 — Package share grants are not platform scope grants
— person-to-person
package_share_grantsstay separate from admin-minted platformpackage_scope_grants; grantpinis not an import specifier pin
Historical / UI / implementation
Accepted or superseded records that do not change the next product proposal. Do not treat this list as homework. History stays; it is not silently deleted.
- 0035 — Platform packages are execute-only; person packages must fork — superseded by 0036; execute-live half is gone
- 0014 — Platform scopes resolve live; person-account imports stay caller-owned — superseded by 0035 then 0036
- 0009 — Shiki for in-app syntax highlighting — library pick; the highlighter is already in the app
- 0010 — One RecordTable for account and admin list/detail screens — superseded by 0028; UI diary (working notes are not steering)
- 0012 — Client-safe shared code lives in
#universal/*— encoded by import boundaries and lint - 0016 — Extract the package runtime and jobs lanes into separate workers — landed; see the architecture runbooks
- 0018 — Inbound CLA for external contributions to this repository — legal/process; see CONTRIBUTING.md
- 0019 — Self-hosted Nx remote cache (not Nx Cloud) — contributor infra, not a product primitive
- 0038 — Still no Nx Cloud; split self-hosted cache read and write tokens — token split; who may write is 0040
- 0039 — Same-repo pull_request jobs do not write the Nx cache — superseded by 0040
- 0040 — Same-repo writers may PUT the Nx cache; fork PRs may not — push access already implies the local write token
- 0028 — List/detail records expand inside the table — UI mode assignment (supersedes 0010)
- 0029 — Discord social login and official guild role — superseded by 0030; invite-only membership is no longer the product path
- 0030 — Join the official Discord during social login
—
guilds.joinon Discord social login; token still discarded after the callback