ADR-069: Explicit read-only revision adapters

Date: 2026-10-13 Status: Accepted Author: Rômulo Febasi

Decision

Implement SourceAdapter outside core with Git/Markdown and optional GitHub first. Host-private mappings select exact documents, access subjects and credentials. Shared actors come from verified Root read capabilities; tool arguments cannot impersonate another subject. Recheck native access and current host policy around bounded upstream reads. Return exact revision/digest/access provenance and explicit unavailable status; retain no passage cache.

Notifications are hints. Resolve current revision for every poll; reconcile gaps to latest state without claiming unobserved intermediate history. Keep source evolution/dedup/impact semantics separate in SYN-327. Write-back is a closed disabled capability; broader token scopes cannot unlock it.

Consequences and limits

This yields a usable revision-monitoring slice without implementing an authoring app or mandatory cloud. Each read pays for fresh checks, and source availability depends on upstream access. No offline cached remote text is returned under an obsolete access policy. Local host mappings are capabilities, not a replacement for Febasi authentication; shared mode uses the established authenticated read protocol. Notion/Jira/Confluence/unversioned Obsidian monitoring remain separate adapter work.

See source configuration and coverage, ADR-049 and SYN-335 (#96).