Adrs on ComplyTime

0001 Use Adrs

Wed, 12 Aug 2026 17:09:58 +0000

Status: accepted

Date: 2026-06-05

Deciders: @jpower432

Context#

ComplyTime’s architectural decisions are scattered across OpenSpec specs, CEP proposals, PR discussions, and implementation code. There is no single, browsable record of what was decided and why. Contributors discovering the project must reconstruct rationale from multiple sources.

0002 Gemara Supersedes OSCAL Input

Wed, 12 Aug 2026 17:09:58 +0000

Status: accepted

Date: 2026-02-01 (retroactive)

Deciders: complytime-dev team

Context#

The original compliance pipeline (complyscribe) used OSCAL as both the input authoring format and the runtime data model. This required compliance engineers to work directly with OSCAL’s verbose JSON/XML structures and created tight coupling between authoring tooling and the assessment runtime.

0003 Oci Artifact Distribution

Wed, 12 Aug 2026 17:09:58 +0000

Status: accepted

Date: 2026-02-01 (retroactive)

Deciders: complytime-dev team

Context#

Compliance assessment requires distributing multiple artifact types: policy content (Gemara), assessment logic (ComplyPacks), and potentially provider binaries. Each could use its own distribution mechanism (RPM, git clone, manual placement, custom APIs).

0004 gRPC Provider Plugin Architecture

Wed, 12 Aug 2026 17:09:58 +0000

Status: accepted

Date: 2026-02-01 (retroactive)

Deciders: complytime-dev team

Context#

complyctl needs to orchestrate multiple evaluation engines (OpenSCAP for filesystem scanning, AMPEL for API-based assessment, OPA for policy-as-code). Each engine has different runtime requirements, dependencies, and release cadences.

0005 Two Stream Content Model

Wed, 12 Aug 2026 17:09:58 +0000

Status: accepted

Date: 2026-05-07 (retroactive — formalized in CEP-0001)

Deciders: @jpower432

Context#

Compliance assessment involves two distinct concerns with different authorship boundaries:

0006 Complypack Content Envelope

Wed, 12 Aug 2026 17:09:58 +0000

Status: accepted

Date: 2026-06-04 (retroactive — CEP-0001 merged)

Deciders: @jpower432

Context#

The original ComplyPack proposal (PR #3 OpenSpec) bundled both the evaluation plugin (Wasm binary) and assessment content (Rego/CUE) in a single OCI artifact. One pull gave you everything needed to evaluate.

Adr Template

Wed, 12 Aug 2026 17:09:58 +0000

Status: [proposed | accepted | deprecated | superseded by ADR-NNNN]

Date: YYYY-MM-DD

Deciders: [who was involved]