Decisions

Each architecture decision record (ADR) captures one decision that shapes kndl: the context, what was decided and what it costs. They are kept in docs/adr/ in the repository and rendered here unchanged. A decision that was replaced stays, marked superseded, so the history reads in order.

ADR	Decision	Status
0001	Claude Code runs on the host; every file and command tool runs in the Sandbox	superseded by 0013
0002	Sessions use the Runner login; the Hub never handles Claude credentials	superseded by 0015
0003	Sessions have no owner; they belong to their Repo	superseded by 0026
0004	The Sandbox is the security boundary: no tool approvals, unrestricted network	accepted
0005	Git remote operations run on the host; no GitHub token enters the Sandbox	superseded by 0010
0006	The Workspace lives on the host; Sandboxes are disposable	accepted
0007	microsandbox is the first Sandbox backend, behind our own interface	accepted
0008	Bun, Effect and SQLite on the backend; React and Base UI on the web	accepted
0009	Sandboxes are built from the Repo’s Environment	accepted
0010	The Sandbox gets a short-lived GitHub token; plain git and gh do the rest	accepted
0011	Runners follow the Hub’s commit, from main only	accepted
0012	Sessions delegate work to Child Sessions	superseded by 0014
0013	Claude Code runs in the Sandbox; a Runner proxy holds the Claude credential	superseded by 0026
0014	Claude Code’s subagents replace Child Sessions	accepted
0015	Each person brings their Claude credential; a Session runs on its Creator’s	superseded by 0026
0016	Forwarding a Session’s ports through the Hub, with a CLI the Hub serves	accepted
0017	The name is kndl	accepted
0018	Steering a prompt into the running Turn	accepted
0019	Invites decide who gets in	accepted
0020	Plugins are remote MCP servers whose credentials the Hub holds	accepted
0021	Plugin icons are fetched by the hub, never by the browser	accepted
0022	kndl serves MCP servers, and nothing else, as what a Plugin was	accepted
0023	Sessions can work directly on a branch	accepted
0024	Attachments reach Claude through a tool the mod registers	accepted
0025	Releases and Channels	accepted
0026	A Session runs on its Creator’s setup token, in the Sandbox, and only its Creator drives it	accepted
0027	Anyone who sees an Archived Session can purge it	accepted