Decision record For everyone

0002 · The control plane is a database of its own, apart from the warehouse

Status: Accepted
Date: 2026-08-04

Context

The record of decisions has to outlive any rebuild of the data it governs, and an audit trail stored inside the thing it audits can be lost or rewritten with it.

Decision

SQLite holds the control plane (var/dpf.sqlite3): requirements, contracts, releases, approvals, the audit log. The warehouse — DuckDB locally, Databricks in production — holds data only, behind the warehouse.py interface. All control-plane SQL lives in repo.py; audit_log, approvals, promotions and requirement_revisions are append-only.

Consequences

The DuckDB warehouse is disposable (dpf load rebuilds it byte-identical) and a second engine was added without touching callers above the seam. SQLite caps write concurrency at one writer, which two gunicorn workers and short transactions live within; a deployment with many concurrent writers would need Postgres behind db.py.