Architecture Decision Records¶
ADRs follow MADR format. Every architectural choice is recorded before implementation begins.
Index¶
| ADR | Title | Status |
|---|---|---|
| ADR-0001 | Three-Plane Zero-Trust Model | Accepted |
| ADR-0002 | SPIFFE/SPIRE for Workload Identity | Accepted |
| ADR-0003 | Istio as the mTLS Enforcement Layer | Accepted |
| ADR-0004 | OPA/Gatekeeper Primary, Kyverno Alternative | Accepted |
| ADR-0005 | Vault Primary, AWS Secrets Manager Alternative | Accepted |
| ADR-0006 | ZT Gateway Proxy — Envoy Primary, ghostunnel Alternative | Accepted |
| ADR-0007 | On-Behalf-Of Token Semantics End-to-End | Accepted |
| ADR-0008 | OpenTelemetry as the Observability Wire | Accepted |