Decisions¶
Architecture Decision Records are the durable record of why H2A is shaped the way it is. Each one is locked: superseding a decision means a new ADR, not an edit to an old one. The specification states the rule; the ADR states the reasoning and what it cost.
| # | Decision | Status |
|---|---|---|
| ADR-001 | Identity namespace root | Accepted — production namespace is open gate G1 |
| ADR-002 | Enrollment identity-assurance tiers | Accepted |
| ADR-003 | Subject key custody | Accepted |
| ADR-004 | Grant authorization | Accepted |
| ADR-005 | Ledger external anchoring | Accepted |
| ADR-006 | H2A evidences; it does not enforce | Accepted — supersedes the earlier gate / kill-switch framing |
| ADR-007 | Consent-capture ceremony | Accepted |
| ADR-008 | Signing curve | Accepted |
| ADR-009 | Revocation authority sits with the issuer, not the implementer | Accepted — refines ADR-005 and ADR-006 |
| ADR-010 | Trust-anchor governance: pinned by namespace, foundation-bound | Accepted |
| ADR-011 | Commercial model: governed act billed, assurance-priced | Accepted |
| ADR-012 | Exposure fields are an optional profile, never Core | Accepted |
| ADR-013 | Reserved — executor tiers T0–T3 | Not yet written |
| ADR-014 | Canonical form and signature encoding | Accepted |
Most recent. ADR-014 makes RFC 8785 JCS the normative canonical form and
fixes alg: "ES256" as the JOSE raw R‖S encoding, never DER. It exists because measurement found
four canonicalisers and two signature encodings across implementations that all believed they
agreed — and the two non-conforming ones were wrong in disjoint ways, so each matched the other on
ordinary payloads and diverged only on real ones: a name carrying a diacritic, a lease cap written
500.0 rather than 500. The ADR ships normative test data
(interop/vectors/) anchored to
RFC 8785's own published sample. An implementation is conformant if and only if it reproduces every
vector byte-for-byte; prose describes the canonical form, the vectors decide it.
ADR-013 is deliberately absent, not missing — it is reserved for the executor-tier decision.