설계 결정 기록¶
설계 이력과 구현 계약입니다. 각 기록의 상태를 확인하세요. 설계가 승인되었다고 운영 환경 검증까지 완료된 것은 아닙니다.
현재 동작은 배포 프로파일에서 확인하세요. 아래 ADR은 역사적 맥락을 보존하는 영어 원문입니다.
- ADR-001: Minimal embedded admin key console
- ADR-002: Admin console grows into an operator dashboard (still toolchain-free)
- ADR-003: Governance differentiation vs LiteLLM — v0.2 priority ordering
- ADR-004: OIDC admin authorization — resource-server-only, break-glass preserved
- ADR-005: Provider visibility in the console; UI-write deferred
- ADR-006: Config hot-reload via a single atomic topology generation
- ADR-007: Chargeback report from the audit log (
inferplane report) - ADR-008: UI-write provider registration — DB-authoritative topology store with Git export
- ADR-009: Opt-in PII masking filter — the honest cache/cost trade-off
- ADR-010: Self-service key issuance — identity endpoint + console
- ADR-011: OpenTelemetry trace spans (GenAI conventions), opt-in
- ADR-012: S3 Object Lock audit anchoring — tamper-evident → tamper-resistant
- ADR-013: Multi-replica HA — shared state design (implementation deferred)
- ADR-014: Provider registration UX — LiteLLM-parity guided "Add Model", secret-ref-honest
- ADR-015: Analytics Mode B — shared Postgres store + fenced single-writer aggregator
- ADR-016: Teams as first-class keystore records (D3) + derived read-only Users
- ADR-017: Budget-alert webhooks (D5b)
- ADR-018: Opt-in request/response body logging (D4)
- ADR-019: Bedrock Guardrails data-plane application + per-team override (D6)
- ADR-020: Per-team region locking (D7)
- ADR-021: Ticket-driven UX fixes — discoverable errors, model aliases, self-service usage
- ADR-022: Bedrock legacy extended-thinking rewrite for newer models
- ADR-023: Declarative virtual keys (config-managed, restart-durable)
- ADR-024: Bedrock InvokeModel passthrough ingress
- ADR-026: Admin console SSO login — SPA-as-OAuth-public-client (ADR-004 revision)
- ADR-027: Admin console i18n — self-contained en/ko/zh/ja dictionary
- ADR-028: CLI OIDC login — short-lived, auto-renewing virtual keys
- ADR-029: model-level fallback (unrouted-model and cross-model-404)
- ADR-030: Cost settlement correctness — streaming usage, cache tiers, and unpriced routes
- ADR-031: Monorepo split into control plane (inferplaned) and node-local data plane (mayu)
- ADR-032: Policy money unit, user/team subjects, and governance cadences
- ADR-033: Local GovernancePolicy file channel (standalone mode)
- ADR-034: Control-plane policy distribution and budget-lease protocol
- ADR-035: Kubernetes policy channel — CRD manifest + ConfigMap-mounted documents
- ADR-036: Control-plane usage telemetry — cost/usage visibility on inferplaned
- ADR-037: inferplaned console SSO — OIDC/Cognito login for the usage console
- ADR-038: Control-plane policy store — Postgres-backed GovernancePolicy writes
- ADR-039: TPM true-up, cache-aware quota, and explicit unlimited rules
- ADR-040: Credential brokering — inferplaned vends short-lived Bedrock credentials to mayu
- ADR-041: Budget-tier model substitution (routing.budgetTiers)
- ADR-042: Calendar budget windows through the policy and lease channel
- ADR-043: Policy-aware routing with local inspection
- ADR-044: Stable adaptive routing for coding agents
- ADR-045: Durable global budget escrow
- ADR-046: Postgres shared gateway governance
- ADR-047: Codex provider compatibility
- ADR-048: Verified identities with stable accounting references
- ADR-049: Task-oriented admin workspaces with explicit evidence and change review
- ADR-050: User cost visibility and profile-aware budget/token policy guides
- ADR-051: Cost-first dashboard and comparative budget table
- ADR-052: Native Converse ingress and governed administrator comparison
- ADR-053: Request outcomes and cost evidence
- ADR-054: Local monetary liability per provider attempt
- ADR-055: Select structural inspection from effective privacy policy
- ADR-057: Audit console evidence