docs(adr): define decentralization roadmap and trust boundaries

[flo2517]

Motivation

Milestones v3.0 → v6.0 describe the decentralized P2P cloud this project is aiming at, but none of it was implementable. AGENTS.md's "Prohibited Changes" section bans "another database, direct Agent-to-chain access, runtime orchestration" in absolute terms — which is exactly what #50, #53, #56, #33, #58 and #59 require. The stated escape hatch is "every architecture change requires an ADR", and there was no ADR to point at. Issue #32 asks for that ADR and states that no architecture implementation starts before it is accepted.

Behavior

Documentation only. No code, origin, storage item, or contract changes.

docs/adr/012-decentralization-roadmap-and-trust-boundaries.md (new) — follows the structure of ADR-011:

1. Vocabulary — fixes the Worker / Network Validator / Chain Authority / Control Plane replica / gateway / storage node / tenant / governance terms once.
2. Trust and threat model per role: what each may assert, what it is trusted for, what it must never be trusted for, adversarial modes. Restates the two unsolved cross-cutting threats (operator-level collusion, bootstrap centralization).
3. Data classification for the 12 classes named in Define the decentralization roadmap and trust boundaries #32 × integrity / availability / privacy / retention → Stage 0 placement and target placement. Adds the one-way rule: no tenant payload, log, secret, or personal data on-chain, ever, because consensus state cannot be erased.
4. Cross-cutting guarantees — finality, conflict resolution, replay protection (generalizing the existing LastProofSequence + deadline pattern rather than inventing a new one), data availability, erasure/GDPR, key rotation and recovery.
5. Five-stage migration mapped onto the existing GitHub milestones, so the roadmap and the tracker cannot drift.
6. ADR gate table — ADR-013 through ADR-020, each naming the issues it unblocks and the prohibition it must lift. Three issues (Stream real-time payments for consumed resources #51, Implement the Proof of Resource protocol #57, Add an infrastructure topology DSL for P2P IaC #63) are explicitly marked as needing no new gate, with the reason.
7. Trade-offs and rollback per stage.
8. What is explicitly out of scope.

AGENTS.md — adds a short Staged Architecture section pointing at ADR-012, and splits the prohibition list into prohibitions no ADR lifts (hard-coded secrets, contract changes without consumer analysis, detailed metrics or tenant data on-chain) and prohibitions gated on a named ADR. No rule is weakened: the Security, Integration and Contract, and Working Method sections are byte-identical, and the frozen architecture stays frozen — it just has documented doors.

ROADMAP.md — extended from v1.0 to v6.0 to match the ten GitHub milestones, each with its issues and its ADR gate. States that ROADMAP.md and the milestones are the source of truth over architecture.md / architecture_review.md, which carry an older conflicting numbering.

Affected components

None at build time. This constrains future work in blockchain/, control-plane/, provider-agent/, and protocol/.

Relationship to existing ADRs

• ADR-008 stays accepted and operative for Stage 0. ADR-012 refines its boundary per data class and adds a target column; the ADR says so explicitly so the two do not read as contradictory. Nothing moves from off-chain to on-chain.
• ADR-011 §5 already stated that slashing economics needed a follow-up ADR before going live. That is now ADR-015 in the gate table.
• ADR-006 still fixes Docker as the runtime; Kubernetes (Add Kubernetes as an optional OpenStack-compatible workload service #27) needs its own ADR.

Rollback

Revert the commit. No migration, no storage change, no generated code.

Verification

• Every file:line citation in the ADR was read and confirmed against the source: AGENTS.md:15,19,23,35; blockchain/runtime/src/lib.rs:160-161,208,219,241,316; blockchain/pallets/availability/src/lib.rs:102-105,308,350,373; control-plane/migrations/000004_workloads.sql; control-plane/internal/wireguard/wireguard.go; control-plane/internal/dashboard.
• The gate table covers every issue in v3.0–v6.0 (Replace centralized off-chain state with a replicated data plane #33–Decentralize identity, governance, and validator operations #36, Move workload orchestration to on-chain smart contracts #50–Add an infrastructure topology DSL for P2P IaC #63); none is left without either a gate or a stated reason for needing none.
• ROADMAP.md headings match gh api repos/:owner/:repo/milestones (one pre-existing cosmetic difference left alone: ROADMAP says "v0.3 — Leases and Rewards End-to-End", the milestone says "E2E").
• Only three markdown files are touched; git show --stat confirms no source file is in the diff.

Refs #32

🤖 Generated with Claude Code