Architecture Decision Records (ADR)
This is a rendered copy of docs/adr/README.md, read in place from the repository — see therecords index for how to read it. If this page and the source file ever disagree, the source file is correct.
Architecture Decision Records (ADR)
This directory contains Architecture Decision Records (ADRs) for QAuth.
What is an ADR?
An ADR is a document that captures an important architectural decision made along with its context and consequences.
ADR Index
| ID | Title | Status | Date |
|---|---|---|---|
| 001 | JWT Key Management Strategy | Accepted | 2026-01-15 |
| 002 | Identifier Abstraction — Email as Credential, Not Identity | Accepted | 2026-03-11 |
| 003 | CredentialProvider Abstraction for Authentication Methods | Accepted | 2026-03-11 |
| 004 | Wallet-Agnostic VC Federation via OID4VP | Accepted | 2026-03-11 |
| 005 | Post-Quantum Cryptography — Hybrid Signing Roadmap | Accepted | 2026-03-18 |
| 006 | OAuth Grants — client_credentials, client_secret_basic, and aud Claim | Accepted | 2026-04-16 |
| 007 | MCP-First Positioning — OAuth 2.1 Authorization Server for MCP / AI Agents | Accepted | 2026-06-23 |
| 008 | Environment-Aware Authorization Posture | Accepted | 2026-06-25 |
| 009 | Wallet Account Resolution — asserted-lookup Default and the Subject-Identity Model | Accepted ⚠️ | 2026-07-20 |
| 010 | eIDAS Level of Assurance → OIDC acr Value Mapping | Accepted | 2026-07-27 |
| 011 | Enterprise-Managed Authorization — Consuming and Minting ID-JAG | Accepted | 2026-08-06 |
| 012 | Ownership of Dynamically Registered Clients | Accepted | 2026-08-31 |
| 013 | Same-Device Return Leg — the OID4VP Response Code on Both Verifier Profiles | Accepted | 2026-09-11 |
| 014 | Authority Tree — Session-Rooted, Sender-Constrained Delegation | Accepted | 2026-09-21 |
| 015 | Authority Tree Hardening — Where a Tree Ends, Who May Act on It, How an Agent Changes Hands | Accepted | 2026-09-30 |
| 016 | Agent Platform Bindings — Public Identities, Approval-Only Resources and Pass-Through Legs | Accepted | 2026-09-30 |
| 017 | First-Party Login — Headless Sign-In on the Authorization Challenge Endpoint | Accepted | 2026-09-26 |
| 018 | QAuth 1.0 — Scope, Stability Promise and Release Path | Accepted | 2026-10-09 |
| 019 | Deployment Topology, Trust Boundaries and Key Custody | Accepted | 2026-10-09 |
| 020 | 1.0 UI Surfaces and Acceptance Criteria | Accepted | 2026-10-10 |
| 021 | Flows and UI as Semantic Graphs | Accepted | 2026-10-10 |
⚠️ ADR-009 — findings partially superseded by CIR (EU) 2026/1730 and 2026/1731 (published 22 July 2026, in force 11 August 2026). No Decision has been changed; one item is flagged as needing a human call. See ADR-009 § Drift re-check (2026-07-26) and the EUDI Regulatory Drift Log.
ADR Template
When creating a new ADR:
- Copy the template below
- Name the file
NNN-short-title.md(e.g.,002-database-strategy.md) - Fill in the sections
- Update this index
# ADR-NNN: Title
**Status:** Proposed | Accepted | Deprecated | Superseded**Date:** YYYY-MM-DD**Authors:** Names
## Context
What is the issue that we're seeing that is motivating this decision?
## Decision
What is the change that we're proposing and/or doing?
## Consequences
What becomes easier or more difficult to do because of this change?
### Positive
### Negative
### Neutral
## Related
Links to related ADRs, RFCs, or issues.