Architecture decision records

One record per decision that would be expensive to reverse. Each states what was chosen, what was rejected, and what it costs — the rejected options matter as much as the choice, because the next person to question a decision deserves to know it was already considered.

#	Decision	Status
0001	Record architecture decisions	Accepted
0002	Single org per deployment	Accepted
0003	Go, shipped as a single static binary	Accepted
0004	Three spaces: raw, wiki, output	Accepted
0005	Postgres is truth, Typesense is derived	Accepted
0006	Inline markdown links with relative `.md` hrefs	Accepted
0007	QuickJS on wazero for user automations	Accepted
0008	Tombstone deletion with pending link decisions	Accepted
0009	Transactional outbox for all derived state	Accepted
0010	CoDNA does not call an LLM	Accepted
0011	OCI containers, Podman first, three deployment strategies	Accepted
0012	MCP authenticates via OAuth against your IdP	Accepted
0013	No administrators; management is a token, not a person	Accepted
0014	Standing folder shares	Accepted
0015	Images and files belong to a page	Accepted
0016	An export is imported into raw, and a newer export adds versions	Accepted
0017	Recordings become raw transcripts, through a transcription service	Accepted
0018	Meetings are held through a meetings service and recorded one person to a track	Accepted
0019	Diagrams are Mermaid text, drawn by the web UI	Accepted
0020	Anyone who can edit a page can share it	Accepted
0021	An agent is a member of an instance, and knows what is shared with it	Accepted
0022	A skill is a page in the wiki's skills folder, and agents are told which they can read	Accepted

Format: Context · Decision · Consequences · Alternatives rejected.