ADR-012: Versioned regional platform contracts and controlled adoption

Status: accepted educational architecture, not production approval. Module: T18.13. Date: 2026-11-02. Supersedes: none; prior runtime decisions remain in force. Amended by: ADR-013 for route authority placement and dual-run economics; the figures under Economics assume no overlap.

Four hypothetical teams copy supplier configuration and release logic, creating inconsistent regional/model gates. T18.12 already defines regional cells and recovery constraints. Centralisation must preserve them and the runtime contracts from ADR-001–010.

Add an application manifest and control plane for desired state, plus a durable migration controller. Keep customer execution in approved regional cells. Platform owns contract enforcement, app teams own task behaviour and outcomes, security/data owners own current purpose/access, and SRE/database owners own recovery authority. Use a named decision owner and record dissent and revisit triggers.

Inventory first, validate manifests, shadow only eligible read-only work, pilot one app/cell, switch one authoritative route with generation checking, and expand only after outcome/cost agreement. Recheck current eligibility for both cutover and rollback. Never restore revoked policy, old source visibility, uncertain external effects, or an incompatible schema through routing rollback.

SQLite tests establish durable scoped proposal identity, conflict rejection, trusted shadow metadata, a deterministic sample gate, atomic route/previous/generation updates, injected rollback before commit, restart inspection, stale-update rejection, and currently eligible reversal. This is migration metadata only. It does not execute customer work, attest comparison evidence, enforce production identity, deploy services, migrate schemas/data, fence remote writers, or integrate previous runtime fixtures. Eligibility flags represent trusted external decisions.

At the guide's illustrative assumptions, 600 migration hours cost $60,000, net monthly savings are $4,000, break-even is 15 months, and three-year savings are $84,000. An extra 40 support hours/month removes operating savings. Track adoption friction, blocked changes, stale generations, pilot outcomes, support hours, regional capacity, and actual cost per successful workflow.

Revisit when pilot support burden removes the business case, measured regional enforcement fails, a contract cannot evolve compatibly, a team needs proven independent scaling/ownership, or customer requirements change durability/geography. Production approval requires real integration and measured operating evidence. Research specialisations remain deferred.

• An application manifest, a desired-state control plane and a durable migration controller enforce shared contracts, while customer execution stays in approved regional cells. Platform owns enforcement, app teams own task behaviour, security and data owners own access, and SRE owns recovery.
• One global request service is rejected for its residency coupling and global blast radius. Library templates alone let versions drift and duplicate policy in apps, and a full microservice rewrite is deferred until a measured need.
• Adoption runs inventory, manifest validation, eligible read-only shadows, a one-app pilot and one generation-checked route switch. ADR-013 replaces its economics, because the 15-month break-even and $84,000 three-year saving hold only if old paths stop on day one.