Architecture Decision Records
On a solo engineering team there is no second human reviewer to catch a boundary violation. Every ADR below is paired with a mechanical enforcement gate in CI (AST boundary test, security drift scanner, or environment contract check).
Clerk for Identity Authentication, PostgreSQL for Role Authority
Session tokens establish who the actor is; PostgreSQL profile records establish what the actor is permitted to do.
Strict Layer Boundaries & Unidirectional Import Flow
HTTP route handlers and Server Actions are thin transport adapters that must never import Prisma directly.
Vertical Domain Slicing Over Horizontal Technical Layers
Organize domain logic into 24 isolated vertical slices communicating only via public service contracts or NATS events.
Class A–D Data Classification & Idempotency Replay Sanitization
Prevent Class A (Secrets) and Class B (Sensitive PII) fields from ever persisting in idempotency caches or structured logs.
Background Worker Daemon Isolation from Web Runtime
Offload NATS JetStream consumers, BullMQ queues, Sharp image encoding, and BoQ PDF compilation to a standalone Node.js 24 daemon.
Capability-Based Admin Authorization & Tiered Step-Up Freshness
Why administrative mutations resolve permissions from a database AdminProfile on every request and require step-up re-authentication.
Declarative Audit Logging Inside safeAction
Eliminate manual audit-log omission bugs by making audit metadata a required declarative property of high-risk action definitions.
Strangler-Fig Migrations via Typed Feature Flags with Expiry Governance
Migrate legacy administrative verticals behind typed feature flags enforced by automated CI expiration checks.