ADR-0004: Enforce by default, Observe only as a visible migration mode

Status: Historical proposal (original status: Proposed)
Date: 2026-10-08
Original decision makers: Project architecture/security owners; approval still pending in the original proposal.
Requirements: HG-003, HG-004, HG-021, HG-033, HG-034, HG-043
Original supersession: None; a new decision for the proposed product.

Note

This is the full English translation of the historical proposal dated 2026-10-08, originally Proposed. Its pending approval is historical and creates no additional alpha approval gate. Current Security model and limits, Development and tests, Verification report and Requirements and security invariants describe the operative scope and evidence.

The later single-package decision is recorded in ADR-0015: One installable extension.

Context

A newly installed security extension creates an assumption of protection. Silent fallback without cURL or with invalid policy would violate that assumption. An existing project also needs controlled inventory of its internal connections. Vault currently deliberately provides weaker behavior without cURL.

Sources: [S04-S06, S16].

Decision

New installation: enforce, with no internal grants. Missing optional configuration uses safe defaults; invalid existing configuration fails. Unsupported transport conditions block before contact with the target or proxy.

observe is an explicit operator decision. Where verifiable, it records would_deny or unverifiable, but delegates to the previous transport and must not be considered protected. A diagnostic problem must not appear there as a successful security check. Existing Core/Vault controls remain untouched.

disabled is transparent and visible. There is no automatic switch from Enforce to Observe or Disabled. Rollback and exceptions require changes to trusted project configuration. No switch may come from an HTTP parameter or a remote response header.

Rejected alternatives

Observe as the installation default: does not initially provide the expected protection.
Warn instead of blocking transport gaps: makes loss of the invariant difficult to recognize.
Fail open on configuration errors: a typo would expand permissions.

Consequences

Failures are unambiguous; existing installations may fail after activation until legitimate internal accesses are recorded. Rollout needs an inventory, diagnostics and deliberate authorization. Observe telemetry does not qualify the Enforce transport.

Evidence and acceptance in the original proposal

T005, T006, T042, T065, T066, T067. Details and expected results are in Original verification specification. These tests were specified, not executed as part of the original documentation delivery.

Reasons to reconsider

Changing the installation default is a product-wide security/compatibility decision. Automatic downgrading remains prohibited regardless.