docs(adr): ADR-015 — why this repo imports another project's Appwrite client

[Polichinel]

B2 of the sequenced plan. Pure writing, no code — and the condition the þing-02 ratification attached to #146, which had not been met.

Why this exists

The deferral's reasoning lived only in a GitHub issue and in the platform's deliberation folder, outside this repository. That is precisely what the ratification objected to: "an issue reads as 'not done yet'; an ADR reads as 'decided, for these reasons, until this condition changes'."

The word deferred was doing real work and was easy to misread. It does not mean not done yet — it means examined, decided, and held under a stated condition. Those read identically in an issue tracker and completely differently to someone deciding whether they may change the code.

What it records

Why the import stays. A hand-written client here would be the platform's third copy — and the defect that prompted the assembly was common to the two existing copies, not a divergence between them. Upstream declines to export a client surface, deliberately, because exporting the current one would bless a shape its own maintainers have recorded as needing decomposition. There is nothing to unwind to.

What bounds it. An importer allowlist pinned by test; the _ContractStorePort DIP port (four methods, so the wire modules never see Appwrite types); and the framework-contract test added with the 3.0.0 bump. Containment, not removal — C-40 stays open on exactly this residual.

The trigger, in plain words. Demand — a second incident rooted in duplicated client code. Supply — upstream carving the auth/config seam out of its Appwrite module. Either means revisit; both mean do it. Explicitly not "when this team gets round to it".

Two things found while writing it

1. The supply half has partially moved, and nothing recorded that. The verdict was written against a single 3,064-line module. Version 3.0.0 relocated provisioning and transport out of it and added an audit package — 2,841 lines now. Still no exported client, so the trigger has not fired. But "no movement" would be the wrong thing for the next reader to believe.

2. The sibling obligation from the same verdict is discharged. It required this repo's legacy delivery path to be guarded or retired before 2026-11-30. It was retired in S1 — Delete the retired delivery path; refuse an incomplete config #149; C-63 is resolved; the deadline is moot here. Nobody had recorded that it was met — a dated cross-repo obligation quietly satisfied.

Also noted in the appendix: C-221 in the verdict is pipeline-core's register entry, not issue #221 (unrelated, closed). This repo namespaces cross-repo identifiers for exactly that reason; the verdict's shorthand does not.

Verification

Every factual claim checked against the installed wheel and the repo, not the changelog: file.py at 2,841 lines, provisioning.py/transport.py/audit/ present, no client surface exported, the allowlist test present, the port's four methods enumerated, C-63 resolved, issue #221 unrelated.

372 passed / 40 xfailed / 0 failed
ruff check .  ->  All checks passed!

Indexed in docs/ADRs/README.md; C-40 now points at it. #146 stays open — the ADR records the deferral, it does not discharge it.