PalladiumWallet/docs/adr

Architecture Decision Records

One ADR per feature or significant design decision. Format: template.md. Workflow: ../docs-as-code.md.

#	Decision	Area	Status
0001	Record architecture decisions as ADRs	Process	Accepted
0002	One shared Avalonia UI with thin platform heads	Architecture	Accepted
0003	Layered architecture: Core knows nothing about the UI	Architecture	Accepted
0004	Centralize all chain constants in a network profile	Chain	Accepted
0005	Use NBitcoin for protocol primitives, hand-write only the rest	Crypto	Accepted
0006	Anchor headers to hardcoded checkpoints and skip PoW validation	SPV	Accepted
0007	Verify a Merkle proof for every confirmed transaction	SPV	Accepted
0008	Progressive verification: show early, spend only after proof	SPV	Accepted
0009	Hand-written Electrum JSON-RPC client with pipelining and an in-flight cap	Network	Accepted
0010	TOFU certificate pinning for indexing servers	Network	Accepted
0011	Server registry seeded by bootstrap list and peer discovery	Network	Accepted
0012	Wallet file encrypted with AES-256-GCM and PBKDF2-HMAC-SHA512	Storage	Accepted
0013	Versioned JSON wallet document with an offline sync cache	Storage	Accepted
0014	BIP32/39 HD wallets with BIP44/49/84 paths and SLIP-132 keys	Crypto	Accepted
0015	Imported-key and watch-only accounts	Wallet	Accepted
0016	Route every signing flow through PSBT	Wallet	Accepted
0017	Coin selection, fee and confirmation policy	Wallet	Accepted
0018	Exclusive OS-level lock on the open wallet file	Storage	Accepted
0019	Resolve the data root by explicit precedence	Storage	Accepted
0020	A single ViewModel split into partial classes by feature	UI	Accepted
0021	In-app overlays instead of OS windows	UI	Accepted
0022	In-code localization table for seven languages	UI	Accepted
0023	Best-effort update check against GitHub releases	Distribution	Accepted
0024	A CLI front end on the same Core	Distribution	Accepted
0025	Test the network layer against an in-process fake server	Testing	Accepted
0026	Fuzz every untrusted-input parser	Testing	Accepted
0027	Server probe tool and opt-in live-server test	Testing	Accepted
0028	Reproducible release builds inside pinned Docker images	Distribution	Accepted
0029	Persistent Android release keystore kept out of git	Distribution	Accepted
0030	Single-source versioning with a mandatory changelog entry	Distribution	Accepted
0031	Explicitly defer multisig, Lightning, Tor and hardware wallets	Scope	Accepted
0032	Run tests, fuzz smoke and docs checks in GitHub Actions	Testing	Accepted
0033	Test the UI layer and CLI headlessly, gate coverage	Testing	Accepted
0034	Bound every network request with a timeout	Network	Accepted
0035	Cap the length of a server line	Network	Accepted
0036	Verify the chain identity of a server right after connecting	SPV	Accepted
0037	Derive an address private key only when it is revealed	Security	Accepted
0038	CLI password sources and explicit plaintext storage	Distribution	Accepted

ADRs 0002 onwards were written retroactively on 2026-11-03 from the code, comments and changelog. If one misstates the original reasoning, fix it in a pull request.