Architecture Decision Records
ADRs explain why LSF works as it does and which constraints an implementation must preserve. Acceptance records an architectural decision; availability comes from the current implementation and its qualification. Superseding a decision requires another ADR with an explicit scope.
Current implementation
The standalone node executes Component Model capsules in fresh Wasmtime Stores, resolves immutable local routes and uses activation-scoped capability grants. It provides exact publication admission, bounded OCI transfer, isolated compiler work, authenticated native reuse, managed delivery and shared HTTP ingress. The closed Angular renderer and static web targets use that shared ingress. See the architecture overview, execution profiles and current host ABI for the supported boundary.
Application transactions, durable effect dispatch and clustered control remain planned. A fixed execution-host backend for process-compromise containment is also unavailable. A compiler sandbox does not supply that guest boundary.
Read superseded decisions in context
- ADR-0027 replaces the original one-component/one-publication association with exact tenant-scoped publication authority.
- ADR-0025 separates immediate capability calls from future transactional intents.
- ADR-0029 adds an explicitly configured Bearer transport alongside the restricted static OCI profile. Its tested topology does not imply support for every registry.
- ADR-0032/0033 extend the original ABI with exact HTTP/blob resource ownership; ADR-0035 adds the buffered async application contract.
- ADR-0039/0040/0042 record the shared listener, installed Angular adapter and optional scoped backend request beyond the initial renderer qualification.
- ADR-0043 adds a distinct static target. ADR-0044 supersedes its original old-format recovery policy and the obsolete catalog/selector compatibility in ADR-0019/0027.
- ADR-0041 governs documentation ownership, versions and publishing. A working website build does not complete human guide review or authorize a runtime release.
Dates, original rationale and historical measurements remain useful decision history. Current guides and reference pages must use the implemented contract; old implementation snapshots are not setup instructions.
Decision index
Runtime and authority
- ADR-0001: Use Rust for the runtime
- ADR-0002: Use the WebAssembly Component Model
- ADR-0003: Use WIT as the capsule contract authority
- ADR-0004: Use Wasmtime as the first execution engine
- ADR-0005: Forbid per-service idle execution allocation
- ADR-0006: Use reusable generic execution cells
- ADR-0007: Distribute capsules as OCI artifacts
- ADR-0008: Compile AOT artifacts only in a trusted boundary
- ADR-0009: Use capability-based host access
- ADR-0010: Separate immutable capsule metadata from deployment policy
- ADR-0011: Keep the control plane out of the invocation hot path
- ADR-0012: Place remote invocation behind a WIT-native transport abstraction
- ADR-0013: Use explicit state transactions and effect intents
- ADR-0014: Do not promise universal exactly-once external effects
- ADR-0015: Build a single-node stateless fabric before clustering
- ADR-0016: Keep paging, continuation eviction, and fusion optional
- ADR-0017: Use fixed trust-class execution hosts for stronger containment
- ADR-0018: Treat Latent Service Fabric as a working name
Packages, trust and activation ownership
- ADR-0019: Separate package identity from component identity
- ADR-0020: Validate supplied components without executing guests
- ADR-0021: Bound registry authority and transfer ownership
- ADR-0022: Bind publisher proofs to current explicit trust
- ADR-0023: Bind build attestations to observed inputs and builder trust
- ADR-0024: Bind SBOM inventory through package content
- ADR-0025: Separate immediate capability operations from transactional effect intents
- ADR-0026: Require explicit execution isolation profiles
- ADR-0027: Separate publication authority from component identity
- ADR-0028: Retain activation ownership across asynchronous waits
- ADR-0029: Separate registry authority from transport profile
- ADR-0030: Bound disconnected authorization validity
Capabilities and application hosting
- ADR-0031: Version host ABI recognition independently of provider authority
- ADR-0032: Use bounded owned resources for streaming HTTP
- ADR-0033: Use scoped durable local blobs with owned chunks
- ADR-0034: Version maintained guest build provenance profiles
- ADR-0035: Bound HTTP application values and delivery ownership
- ADR-0036: Publish HTTP triggers with exact catalog target pins
- ADR-0037: Qualify a closed Angular Component Model renderer profile
- ADR-0038: Admit web packages with componentless publication authority
- ADR-0039: Bound the shared HTTP listener and preserve selected admission
- ADR-0040: Run the closed Angular adapter in fresh generic Stores
Documentation and current alpha contracts
- ADR-0041: Publish single-source, version-bound documentation
- ADR-0042: Bound Angular render data through the capability broker
- ADR-0043: Select static web publications as first-class HTTP targets
- ADR-0044: Remove obsolete alpha compatibility
- ADR-0045: Bound larger static documentation inventories
- ADR-0046: Opt in to public document navigation
- ADR-0047: Reconcile static route sets with durable intent
- ADR-0048: Expose bounded OCI authority in the CLI
- ADR-0050: Plan capacity before deleting publication history
- ADR-0049: Scope cross-origin assets to explicit publications
- ADR-0051: Author static release evidence without a Rust toolchain
- ADR-0052: Authorize exact static style identities
- ADR-0053: Run authenticated native binaries in a bounded container profile
- ADR-0054: Preserve coupled local container state under a shared owner fence
- ADR-0055: Project private HTTP readiness from authenticated observations
- ADR-0056: Run headless operators through a private local transport
- ADR-0057: Pin a local HTTPS edge to an exact native peer
- ADR-0058: Transform static identity bytes at a bounded trusted edge