Architecture decision records
An ADR records one decision: the situation, the options, the choice, and what it cost. Accepted ADRs aren’t edited. A changed decision gets a new ADR that supersedes the old one.
| ADR | Decision |
|---|---|
| 0001 | Record architecture decisions as ADRs |
| 0002 | Rewrite Caproni in Rust as Xianyun |
| 0003 | Compatibility aliases for config, environment, and data paths |
| 0004 | Synchronous CommandRunner as the only process seam |
| 0005 | Allowlist-only MCP server with elicitation gating |
| 0006 | Name-constrained dev CA stored per profile |
| 0007 | Pull-through registry cache, bring-your-own by default with an optional managed zot |
| 0008 | Tiered NixOS VM tests with pinned image digests |
| 0009 | Version 2 configuration only, held as a JSON value and validated against an embedded schema |
| 0010 | mdBook and rustdoc for the Xianyun documentation |
| 0011 | Colima on macOS and k3d on Linux as the local cluster drivers |
| 0012 | mirrord for edit mode, with Skaffold as the fallback |
| 0013 | zot as the managed registry cache implementation |
| 0014 | Registry cache lifecycle: auto-start, never auto-stop, one shared instance |
| 0015 | The registry cache is opt-in and fails soft |
| 0016 | Containerd mirror wiring for the registry cache, and Colima on containerd |
| 0017 | Remove the Go implementation, and publish the documentation through GitLab Pages |
| 0018 | Xianyun collects no telemetry |
| 0019 | NixOS VM scenario tests for the end-to-end behaviour |
Still to migrate
One decision from the Go project’s log isn’t an ADR: using locally rendered templates for edit mode, and deferring Cloud Native GitLab images as the single source of truth. It concerns GitLab’s container images and isn’t yet reflected in Xianyun’s code. The GitLab-specific decision to share one Postgres pod across databases is also not carried over.