This directory holds pk-auth's Architecture Decision Records in
Nygard format,
numbered sequentially. ADRs are append-only: when a decision is reversed, a new
ADR is added and the prior one is marked Superseded by NNNN. See
ADR 0001 for the format itself.
| # | Status | Date | Title |
|---|---|---|---|
| 0001 | Accepted | 2026-05-12 | Record architecture decisions |
| 0002 | Accepted | 2026-05-13 | WebAuthn4J over Yubico java-webauthn-server |
| 0003 | Accepted | 2026-05-14 | JDBI over JPA |
| 0004 | Accepted | 2026-05-14 | Use Dagger 2 for the Dropwizard adapter's DI |
| 0005 | Accepted | 2026-05-14 | Stateless JWT as the default post-ceremony credential |
| 0006 | Accepted | 2026-05-15 | UserLookup is an SPI, not an owned table |
| 0007 | Accepted | 2026-05-14 | DynamoDB Local over LocalStack for integration tests |
| 0008 | Accepted | 2026-05-14 | DynamoDB single-table design for auth items, separate users table |
| 0009 | Accepted | 2026-05-13 | Jackson 3 (tools.jackson) over Jackson 2 (com.fasterxml.jackson) |
| 0010 | Accepted | 2026-05-15 | Track latest Dropwizard rather than pin to 4.x |
| 0011 | Accepted | 2026-05-16 | Spring Boot 4 / Spring Security 7 for the Spring starter |
| 0012 | Accepted | 2026-05-16 | Micronaut 4 for the Micronaut adapter |
| 0013 | Accepted | 2026-05-16 | Rotating refresh tokens with family-based replay detection |
| 0014 | Accepted | 2026-05-16 | Per-audience JWT TTL via a TokenTtlPolicy SPI |
| 0015 | Accepted | 2026-05-16 | Stateful access tokens via AccessTokenStore SPI |
| 0016 | Accepted | 2026-05-16 | User deletion fan-out is sequential and best-effort |
| 0017 | Superseded by 0018 | 2026-06-11 | SonarQube Cloud for static analysis and coverage tracking |
| 0018 | Accepted | 2026-06-11 | Remove SonarQube Cloud; enforce coverage with native JaCoCo line + branch gates |
| 0019 | Accepted | 2026-06-17 | Crypto-agility and post-quantum readiness for passkey algorithms |
| 0020 | Accepted | 2026-06-18 | Browser SDK testing strategy |