Architecture Decision Records

kenny's architecture decisions in MADR format, and the only kind of record kenny keeps. What qualifies: When (not) to write an ADR in the repository CLAUDE.md, applied by /new-adr before it scaffolds anything.

• Numbered NNNN-kebab-title.md as a gap-free 0001..N sequence; the index is the record set, and a number always names the record at that position.
• 0000-template.md is the MADR template — copy it for a new record (/new-adr).
• A record is immutable once accepted; later decisions amend or supersede it via a new record. The one exception: an accepted record may gain a dated ## Update (YYYY-MM-DD) section refining how it is implemented. Anything that changes what was decided needs a new record.
• A number is an address, not content — repairing a link or renumbering is not an edit to a decision.

Index

#	Title	Status
0001	Record architecture decisions using MADR	accepted
0002	Python server, Rust agent	accepted
0003	Self-built WebSocket/HTTPS tunnel	accepted
0004	Agent initiates the outbound connection	accepted
0005	Contract-first development with golden fixtures	accepted
0006	MCP over Streamable HTTP between Claude and the server	accepted
0007	Telemetry push model and SQLite storage	accepted
0008	Operator authentication	superseded by 0033
0009	Server-hosted Claude chat with a confirm-gate	accepted
0010	Containerization (Docker/Compose) and GHCR	accepted
0011	Local remote-control kill switch (tray on/off)	accepted
0012	Agent distribution: prebuilt binary + config injection	accepted
0013	Agent as a Windows service + server-triggered self-update	accepted
0014	Auth hardening: token store, rotation, multi-operator, TLS cookie	accepted
0015	Server auto-fetch of the prebuilt agent binary from GitHub Releases	accepted
0016	Anthropic-native (underscore) capability tool names	accepted
0017	Observability: structured logging and a persistent event store	accepted
0018	Screenshots captured in the user session via the tray helper	accepted
0019	Agent-side deterministic safety guard for dangerous tool calls	accepted
0020	Shared policy catalog, operator deny rules, and a server-side mirror	accepted
0021	Orchestrate Windows Quick Assist as a concierge via user-session launch	accepted
0022	Mutual agent⇄server authentication via per-agent Ed25519 signatures	accepted
0023	Treat agent-supplied data as untrusted in the chat tool-use loop	accepted
0024	Parental controls: web-activity observability and on-demand web filtering	accepted
0025	Persistent, resumable copilot chat history	accepted
0026	LLM categorization of reliability events	accepted
0027	Push alerting via ntfy/webhook and a weekly digest	accepted
0028	Security-inventory and resilience telemetry sections	accepted
0029	Screen time as aggregated whole-machine session minutes	accepted
0030	Agent self-elevating bootstrap installer + fixed install location	accepted
0031	First-class Linux agent support	accepted
0032	Runtime settings resolved DB-over-env, editable in the dashboard	accepted
0033	Multi-user authentication: accounts, roles, sessions, and per-user access tokens	accepted
0034	Linux agent distribution: convenience install script + server-triggered self-update	accepted
0035	Anti-cheat coexistence and publisher legitimacy	accepted
0036	Report CPU arch via telemetry; pin arch for fresh Linux installs	accepted
0037	OAuth 2.1 authorization server for the MCP connector	accepted
0038	Explicit per-call agent targeting for forwarded MCP capability tools	accepted
0039	Server database backup/restore with pluggable local + remote destinations	accepted
0040	Scheduled update detection with a pinned, operator-approved rollout	accepted
0041	Operator-managed reliability alarm suppression	accepted
0042	Account governance across local and Microsoft accounts	accepted
0043	Account governance on Linux	accepted
0044	Delegated identity from a chat platform, with no parallel authorization	accepted
0045	Tiered tool classification: the tier belongs to the tool, the gate to the surface	accepted
0046	The ticket is the entity; the chat thread is a binding	accepted
0047	Capability profiles: named per-user tool allowlists that only narrow	accepted
0048	Second release channel: dev prereleases via the GitHub prerelease flag	accepted
0049	The ticket lifecycle splits into two axes: state and blocked-on	accepted
0050	The ticket is its own chat surface	accepted
0051	Serialize this process's SQLite writers behind an in-process lock	accepted
0052	Build the dashboard as a compiled frontend shipped in the wheel	accepted
0053	Guarded minting, open redemption for agent distribution	accepted
0054	Alert delivery channels are live settings, resolved per dispatch	accepted
0055	Scheduled web-filter enforcement: a standing rule the server enacts on a clock	accepted
0056	Unprompted ticket triage, and what may let it act	accepted
0057	Read GitHub releases anonymously for agent distribution	accepted
0058	Time-aware findings with an incident/posture split	accepted
0059	The inbox is the ticket queue	proposed
0060	The ticket shows findings; the trail stays the audit	accepted
0061	The ticket keeps a record, not a transcript	proposed
0062	A block is machine-written, and a ticket nobody works dies of neglect	accepted
0063	The copilot proposes a ticket; it does not open one	proposed
0064	The fleet declares what a shell may run	accepted
0065	Reliability is scored on user-visible impact	accepted
0066	The Anthropic key is a dashboard setting, kept out of backups	accepted
0067	Alert delivery is routed by actionability	proposed
0068	LLM egress through an operator-configured gateway	accepted
0069	Web filtering is set per host on two axes: enforcement and history	accepted
0070	Long-lived per-device hardware history	proposed