Architecture Decision Records
The format is MADR. Each record has a status: Proposed, Accepted, Superseded by ADR-NNNN, or Deprecated.
Each ADR’s status line gives its approval date.
| # | Title | Status |
|---|---|---|
| 0001 | Rust for all components | Accepted |
| 0002 | Workers terminate protocols; the proxy authorizes and routes | Accepted |
| 0003 | Reverse tunnel: gRPC served by the worker over an outbound connection | Accepted |
| 0004 | Proxy HA through tunnel registry and proxy peering | Accepted |
| 0005 | Single public port with ALPN and path routing behind an NLB | Accepted |
| 0006 | OIDC login with key-bound nonce, short-lived X.509 and SSH certificates | Accepted |
| 0007 | Three CA keys behind a Signer trait, KMS in production | Accepted |
| 0008 | YAML label-based policy, push-applied, signed snapshots | Accepted |
| 0009 | Disk spool, at-least-once delivery, S3 hash chain, Datadog | Accepted |
| 0010 | Aurora PostgreSQL through sqlx; advisory-lock leader election | Accepted |
| 0011 | Control-plane outage semantics and observability stack | Accepted |
| 0012 | Dependency selection and maintenance criteria | Accepted |
| 0013 | Apache-2.0 license | Accepted |
| 0014 | Self-hosted Grafana on ECS over Athena | Accepted |
| 0015 | One IAM-authenticated DB role per policy role | Accepted |
| 0016 | How proxies and workers join: single-use, IAM (planned), static tokens | Accepted |
| 0017 | Web console: read-mostly, server-rendered, built into the control plane | Accepted |
| 0018 | Search, document, and messaging protocols (OpenSearch/Elasticsearch, MongoDB/Atlas/DocumentDB, Redshift, RabbitMQ, Kafka) | Proposed |
| 0019 | Machine identities (bots) for CI and automation | Accepted |
| 0020 | Scale-out: many control planes, proxies, and workers | Accepted |
| 0021 | Documentation site and project homepage | Accepted |
| 0022 | Identity-aware access to internal web apps and TCP services | Accepted |
| 0023 | The roadmap lives in GitHub milestones and labels | Accepted |
| 0024 | Releases and distribution: one version, signed binaries and images, Terraform by tag | Accepted |
| 0025 | Access requests and just-in-time approval (with break-glass) | Accepted (built in Phase 13) |
| 0026 | Searching audit events and recordings, and the auditor role | Accepted (built in Phase 13) |
| 0027 | Resource discovery by workers, with quarantine for tag-derived labels | Accepted (built in Phase 13) |
| 0028 | Policy tooling: test, simulate, diff, explain | Accepted (built in Phase 13) |
| 0029 | Access reviews and compliance evidence packs | Accepted (built in Phase 13) |
| 0030 | Watching a live session (read-only) | Accepted (built in Phase 13) |
| 0031 | Positioning: access you can prove (provable, explainable, justified, agent-ready, open) | Proposed |
| 0032 | AI agents as principals: a bot flavour with accountable owners and per-action approval | Proposed |
| 0033 | SQL database access: PostgreSQL, MySQL, Aurora, Redshift (Phase 6) | Accepted |
| 0034 | Redis and Valkey access (Phase 7): RESP codec in the worker, ACL users, redacted values | Accepted |
| 0035 | MongoDB, Atlas, and DocumentDB access (Phase 9): BSON/OP_MSG relay in the worker, SCRAM/X.509/IAM, redacted command shapes | Accepted |
| 0036 | OpenSearch and Elasticsearch access (Phase 10): HTTP front in the worker, policy by method class and index pattern | Accepted |
| 0038 | Kubernetes (EKS) access through impersonation, with recorded exec (Phase 8) | Accepted |
| 0039 | Detached connections (--detach) and limen conns |
Accepted |
| 0040 | Trace export over OTLP | Accepted |
| 0037 | RabbitMQ, Amazon MQ, Kafka, and MSK access (Phase 11): AMQP and Kafka codecs in the worker, multi-broker slot rewrite, bodies never logged | Proposed |
| 0042 | One management API for the CLI, the console, and infrastructure as code (Phase 14): the limen.manage.v1 contract, one owner per document, scoped bot writers that complete resource profiles, server-side guardrails |
Accepted |
ADR-0013 and ADR-0014 are marked Accepted because the owner decided them directly during Phase 0 clarification. ADR-0018 to ADR-0022 and ADR-0025 to ADR-0032 were requested by the owner on 2026-10-14 and initially marked Proposed; ADR-0022 was accepted when the owner approved its Phase 12 implementation defaults.