Architecture decision records
Every locked design decision in Railroad Network is written down as an
Architecture Decision Record (ADR) in the station repo. ADRs are
append-only: a changed decision gets a new ADR that supersedes the old one.
When a page on this site and an ADR disagree, the ADR wins.
Phase numbering. ADRs written before 2026-08-25 use the old phase numbering, where “Phase 2” meant federation. ADR-0017 resequenced the plan: Phase 2 is now single-community resilience and Phase 3 is federation. ADRs 0001 to 0016 keep the old numbering as written.
The Status column is the ADR’s own status line. Proposed on a decision that has shipped means the maintainer has not yet formally ratified it; the code follows it regardless.
| ADR | Decision | Status |
|---|---|---|
| 0001 | Rust workspace and dual license | Accepted |
| 0002 | Canonical serialization via deterministic CBOR (dcbor) | Accepted |
| 0003 | Human-readable address format: bech32m with HRP rrn | Accepted |
| 0004 | Own Shamir’s Secret Sharing implementation over GF(256) | Accepted |
| 0005 | The station signs settlement and cancellation records | Accepted |
| 0006 | The mobile client holds the keys; the station is a local backend | Accepted |
| 0007 | uniffi-rs generates the mobile bindings to our Rust crypto | Accepted |
| 0008 | The mobile↔station envelope is the security boundary; the transport is a dumb carrier | Accepted |
| 0009 | One reputation formula runs on every station and no community can tune it | Accepted |
| 0010 | A listing is a signed record on the log; the search index is a view that can be thrown away | Accepted |
| 0011 | The Phase-1 oracle ladder: two serviceable tiers, a blocked ceiling, and a derived reputation stake | Accepted |
| 0012 | The Charter: a self-bootstrapping constitutional document, and how a community changes it | Accepted |
| 0013 | Federation and collapse-mode transport is pluggable; Reticulum is the adopted backend, run as an external sidecar | Accepted |
| 0014 | Phase-1 dispute resolution: a sortition jury with a governance backstop, and the Tier-2 stake that finally bites | Proposed |
| 0015 | Bootstrapping the electorate: a governance and dispute grace so a young community can actually govern | Proposed |
| 0016 | Station backup and key recovery: an encrypted archive whose key survives a lost passphrase | Proposed |
| 0017 | Single-community resilience comes before federation | Accepted |
| 0018 | A debt floor bounds how far a member can sign themselves into debt | Proposed |
| 0019 | A freshness bound on confirmed_at protects the dispute window | Accepted (superseded for delay-tolerant sync by ADR-0022) |
| 0020 | The community log keeps one writer; resilience is delay-tolerant submission, not multi-writer merge | Accepted |
| 0021 | Escrowed offline spending certificates bound the debt floor under partition | Accepted |
| 0022 | The admission clock: the station’s clock at admission is the only window-bearing clock | Accepted |
| 0023 | Emergency governance: deciding faster in a crisis without building a coup lever | Accepted |
| 0024 | Station at-rest encryption: a member-keyed encrypted volume unlocked by a boot ceremony | Accepted |
| 0025 | Equivocation cases are a distinct jury case kind with a Lapsed default and identity-anchored sortition | Accepted |
| 0026 | The Reticulum sidecar is ratified: pinned rnsd 1.5, driven from the station, native Rust deferred | Accepted |
| 0027 | Emergency declaration activation is a single first-crossing event, and a part-signed declaration expires | Accepted |
| 0028 | A self-custody CLI member wallet: the non-mobile member device, a sealed-channel client with an offline outbox | Accepted |
Generated page. Built from
docs/adr/in thestationrepo byscripts/gen-reference.sh.