RevRec brainstorm · Direction alignment · DA · Stores & tech
ADR 0004 — Stores and technology choices (model-derived)
Date: 2026-07-30 · Updated: 2026-07-31
Status: Accepted
Deciders: RevRec Next design session
See: 18-architecture-from-model.md
Context
The domain model (Contract → PO → schedule → recognize/close) imposes system properties: transactional SoR, audit/idempotency, per-contract parallelism, immutable source replay, rebuildable analytics, published facts for AC.
Decision
Fill roles derived in doc 18:
| Role | Default technology | Domain property served |
|---|---|---|
| Raw lake | Object storage (S3/GCS) | Replayable source truth |
| Cursors | PostgreSQL | Reliable extract bookmarks |
| Ops SoR | PostgreSQL | Relational invariants for subledger |
| Audit / idempotency | Postgres applied_events |
(tenant, source, source_event_id) |
| Orchestrator | Temporal | Per-contract & close workflows |
| Apply workers | Python domain services | Policy velocity |
| Analytics | ClickHouse (or org OLAP) | Waterfalls/RPO — not SoR |
| Exports | Object storage | Journal/partner files |
| API | Stateless HTTPS | Command/query access |
| Optional cache | Redis as cache only | Latency — never document SoR |
Alternatives within a role are allowed if properties are preserved (see doc 18 §4.1).
Consequences
- Architecture discussions start from domain properties, then pick role fillers.
- Incumbent tools are irrelevant except as migration adapters emitting canonical events.
- Changing a role’s meaning (e.g. OLAP as write SoR) requires a new ADR.
Alternatives considered
| Alt | Rejected because |
|---|---|
| Document DB as SoR | Weak relational invariants for schedules/allocations/periods |
| OLAP as SoR | Wrong consistency for close & amend |
| Cron-only orchestration | Weak long-running per-contract control vs workflow engine |
| Multi-region NewSQL day one | Premature until multi-region active-active is a hard requirement |