Texto del ADR

Leído de docs/decisions/dec-0095-0-rtt-replay-safe-policy-as-annex.md, el fichero canónico.

0-RTT replay-safe policy as annex to F-IDENTITYCopiar enlace

0-RTT replay-safe policy as annex to F-IDENTITY: capability advertisement + prepare query + subscription restoration ALLOWED; denylist mutations + one-time grants + capability elevation FORBIDDEN

Por qué pasa gate-3Copiar enlace

• Hard-to-reverse: Security policy embedded in identity contract. Reversal would require redefining F-IDENTITY security boundaries, ThreatModel-v0 G8, and encryption key management for OfflineBundle. Would be breaking change for any 0-RTT implementation.
• Surprising sin contexto: Without ADR context, engineers implementing 0-RTT resumption would not understand why specific operations are allowlisted/denylisted. 'Prepare query idempotent read = OK' vs 'capability elevation = FORBIDDEN' is non-obvious without security rationale. Annex-to-F-IDENTITY decision (not standalone ADR) is context-dependent choice.
• Trade-off real: Alternative explicitly considered and rejected: '0-RTT replay-safe as standalone ADR' - REJECTED because 'annex to F-IDENTITY is coherent with its scope; standalone would be ADR bloat for 1 paragraph + denylist'. Cost of annex approach = deferred until F-IDENTITY formal documentation; benefit = avoids ADR proliferation for 1-paragraph policy. Trade-off is: coherent scope vs standalone decision document.

ProcedenciaCopiar enlace

Split de docs/decisions/r61-isolation-lifecycle-2026-07-15.md (lock D3) durante PASO 7 (2026-07-16). Ver el fichero padre para el contexto completo del pack original.