Mission Control Architecture Decisions

Target architecture — not the current operating contract

These records explain durable product direction. For available behavior and procedures, see the current release.

Architecture Decision Records preserve accepted boundaries that future feature work must not reverse accidentally. The canonical documentation index identifies the owning product documents; these records explain why the most consequential constraints are durable.

Decision index

1. ADR-0001: Control Kernel and composable modules
2. ADR-0002: Customer-resident AWS-first deployment
3. ADR-0003: Enforced Model and Connector Gateways
4. ADR-0004: MCP-only tool-level Connectors
5. ADR-0005: Thin Retrieval boundary
6. ADR-0006: Native and external Agent runtimes
7. ADR-0007: Key-bound external runtime Runs — superseded by ADR-0010
8. ADR-0008: Managed definitions and the governed chat surface — partially superseded by ADR-0010
9. ADR-0009: The light console theme
10. ADR-0010: Trace-native inference and observability — partially superseded by ADR-0011
11. ADR-0011: Governance record and span store
12. ADR-0012: One Postgres database for governance and application storage

Record rule

New accepted decisions receive the next sequential four-digit number and never reuse an earlier number. A later decision can supersede an earlier record, but it does not edit away the original Context, Decision, Status, or Consequences. The new record links the superseded decision and states the replacement boundary explicitly.

Current governance mapping

The current source release uses Organizations, Teams, real user/service-account virtual keys and separate human management roles. Agent is managed application content; deployments own secretless execution access and publisher funding. Observe uses Requests, Traces, Sessions and Usage with separate metadata/content/export permissions. Historical identity terms in this target proposal are not the operating contract. See Current release.