Build the MVP: validate and carry forward

ADR-001 accepts a synchronous single-application MVP for this educational architecture. Current system records version v0.1-stage-01; it is an accepted teaching baseline, not a deployment approval.

Keep the request schema, scoped history, adapter interface, no-automatic-retry rule, and commit-before-success contract. A future T18.3 starts when document processing or another long task blocks interactive requests or must survive a worker crash. It can introduce durable jobs with a migration decision. No T18.3 artefacts are generated here.

Unresolved pre-pilot questions include real identity/provider contracts, durable hosting, retention and backup deletion, a recovery policy for uncertain rows, measured load/latency, and cost/quota values. Keep these visible rather than marking the platform production-ready.

1. What prevents a model response becoming an unsaved success? Commit completed with the answer before returning 201; return an error if the commit fails.
2. Why not keep the transaction open during generation? It extends lock duration over an unpredictable external call without making that provider part of the transaction.
3. What changes if the same idempotency key has a different prompt? Reject 409; a new intended operation needs a new key.
4. Why does a shorter provider deadline not prove a better SLO? It can replace slow completions with failures. Count errors and measure the actual request population.
5. Can the lab prove identity, TLS, and hosted-provider behaviour? No. Those boundaries are simulated or absent and need separate integration checks.

For a 60-second memory card, recall these seven cues: user outcome first; trusted tenant/user scope; short transaction before model; bounded adapter call; final commit before success; external outcome may be unknown; RPS, concurrency, and tokens use different units.

These boxes are learner work, not claims of mastery. Review after about one, seven, and 21 days.

• Explain the saved-draft contract and acknowledgement boundary without notes in two minutes.
• Draw the Client, AI App Service roles, Metadata DB, hosted-model boundary, and success/failure sequence.
• Defend synchronous JSON and local relational persistence against two credible alternatives under stated constraints.
• Diagnose timeout and final-write failure using status, durable state, and an observable signal.
• Run, modify, and debug the representative slice; retain tenant and duplicate tests while changing the adapter.

Stop after these gates. Defer distributed execution, recovery workers, retrieval, and production infrastructure to their assigned stages.

• The accepted design is a synchronous single-application MVP, a teaching baseline rather than deployment approval. It carries forward the request schema, scoped history, adapter interface, no-automatic-retry rule and commit-before-success contract.
• Durable jobs come next only when a long task blocks interactive requests or must survive a worker crash.
• A shorter provider deadline does not prove a better SLO. It can replace slow completions with failures, so count errors and measure the actual request population.
• The lab cannot prove identity, TLS or hosted-provider behaviour, because those boundaries are simulated or absent. They need separate integration checks before a real pilot.

• RFC 9110: HTTP Semantics: primary reference for HTTP methods and status semantics; application retry/idempotency choices remain explicitly local.
• RFC 6750: Bearer Token Usage: why bearer credentials need protected handling and transport.
• OWASP Authorisation Cheat Sheet: deny by default and verify resource access in trusted code.
• Python sqlite3: parameter binding and transaction API used by the executable.
• SQLite Isolation: local database concurrency/isolation constraints.