Hangar

Docs · Glidepath

Architecture Decision Records

One file per load-bearing decision: what it is, why it was made this way, and what it costs. Written after the fact from the real design/implementation history - see ../../archive/ for the original, unabridged design record these were distilled from.

ADR Decision
0001 Tekton + Pipelines-as-Code, vanilla Kubernetes
0002 CDEvents broker with TokenReview auth for inter-stage chaining
0003 Governance gates as explicit, structurally-loud extension points
0004 GitOps-only release promotion
0005 Per-cluster ArgoCD instances, event-driven outcome reporting
0006 Cluster-agnostic bootstrap, no cluster state in the app repo
0007 Testkube CE in one shared namespace, not one per tenant
0008 Kyverno ValidatingPolicy closes the Testkube shared-secret gap
0009 External Secrets Operator + self-hosted Infisical as the secrets backend
0010 Kaniko for rootless image builds under PSS restricted
0011 Every Application is (at least) two peer namespaces, not one
0012 Ephemeral (PR-preview) environments deploy through airframe-application, TTL-swept
0013 Shared catalog distributed as a git-tag-pinned Helm chart, not a bundle resolver
0014 Keyless signing uses two separate trust roots - public Sigstore for humans, self-hosted Fulcio for workloads
0015 Provenance policy validates the attestation as input, additive to commit signing
0016 Tekton Results for long-term PipelineRun/TaskRun archival
0017 cicd.yaml is scaffolded at onboarding, not hand-authored first

New decisions get a new numbered file here, not a paragraph buried in an unrelated doc.

Note on 0014/0015: distilled from image-signing.md/commit-signing.md/ provenance-policy.md as they stood 2026-09-06. A separate, concurrent session is implementing sigstore end-to-end in GitOps fashion at the time these were written - re-check both against the live mechanism before treating them as current if that work has since landed.