Architecture Decision Records | Dental Platform Docs

Format: [MADR-lite]. Status one of Proposed / Accepted / Superseded. Every ADR lists context, decision, consequences. ADRs are immutable once accepted; changes require a superseding ADR.

#	Title	Status
0001	pnpm + Turborepo + go.work monorepo	Accepted
0002	Go modular-monolith core-api with focused satellite services	Accepted
0003	Next.js App Router apps with BFF cookie sessions (no browser tokens)	Accepted
0004	PostgreSQL 18 with row-level security for tenant isolation	Accepted
0005	NATS JetStream for durable async events and jobs	Accepted
0006	Redis for cache, rate limits, idempotency — never source of truth	Accepted
0007	MinIO tenant-prefixed object storage with opaque keys	Accepted
0008	Keycloak 26 OIDC with passkeys, TOTP fallback, recovery codes	Accepted
0009	OpenBao for secrets and envelope-encryption KEKs	Accepted
0010	RKE2 + Cilium + Envoy Gateway + Coraza on Canadian metal	Accepted
0011	Single ai-gateway with AI_PHI_MODE privacy gate and pinned model routing	Accepted
0012	Hash-chained append-only audit and approval events	Accepted
0013	Immutable versioning for transcripts, notes, plans, templates, documents	Accepted
0014	ContextIsland driven by an explicit typed state machine	Accepted
0015	Hugeicons Stroke Rounded behind a semantic AppIcon registry	Accepted
0016	Envelope encryption: per-tenant DEKs wrapped by OpenBao KEKs	Accepted
0017	Integration adapters behind a uniform port with sandbox fixtures	Accepted
0018	REST + NATS only; ConnectRPC deferred until a justified need exists	Accepted
0019	pgx repositories with hand-reviewed SQL instead of sqlc codegen	Accepted
0020	Built-in evidence-package e-signature; provider abstraction for QES	Accepted