Architecture Decision Records

Each ADR explains a decision and the context that forced it. If you want to understand why the project is shaped the way it is, read them in order.

#	Decision	Why it exists
ADR-001	Tauri as the desktop shell	Any UI would need filesystem/process access; Tauri keeps the trusted surface small.
ADR-002	Documents leave the sandbox as raster only	The worker must never send back anything interpretable (HTML, SVG, links).
ADR-003	gVisor/runsc as the Linux isolation layer	A real kernel boundary for parsing, cheaper than a full VM.
ADR-004	Binary, versioned IPC protocol	Small, quantifiable attack surface; strict validation on both sides.
ADR-005	Hayro as default PDF engine, MuPDF opt-in	MuPDF is AGPL; Hayro keeps the default build MIT-compatible.
ADR-006	QEMU VM layer for Windows/macOS	Same gVisor stack, now inside a disposable VM.
ADR-007	OOXML preview with container caps	Zip bombs and entity expansion need hard, pre-decode caps.
ADR-008	Embedded office media preview	Bounded counts/bytes, sequential decode, same validation path.
ADR-009	Shared-memory page transport (protocol v2)	0-copy frames for the local dev backend.
ADR-010	GIF/TIFF/BMP images, EPUB/RTF/HTML text preview	Same boundaries absorb the formats users actually open; dispatch stays fail-closed.