Accepted means the decision governs architecture; implementation maturity remains separate and is tracked in PRD/Traceability.
| ADR | Decision | Status |
|---|---|---|
| 0001 | Detection truth comes from executable evidence, not registry assertions | Accepted |
| 0002 | Prevention/hardening and scanner detection are separate obligations | Accepted |
| 0003 | External scanner provenance remains explicit | Accepted |
| 0004 | Tenant authority and outbound destinations are explicit security boundaries | Accepted |
| 0005 | Deterministic autofix is limited to proven semantics-preserving transforms | Accepted |
| 0006 | Autonomous development remains separate from independent merge/release authority | Accepted |
Create or update an ADR when changing detector truth semantics, issue obligation coverage, built-in versus external execution, autofix authority, persistent tenant schema/authz, outbound webhook/DAST egress, normalized finding/SARIF identity, or autonomous/release credentials.
Implementation PRs must reconcile PRD/TRD/Architecture/UML/ERD/Threat/Test/Operability/Traceability and CHANGELOG where those contracts move.