Decision: shipped localhost bridge vs ADR-0001 native messaging — re-scope #49/#50 and write the missing ADR

[hellno]

Part of #44. Decision only — no product code.

Resolved 2026-07-10 → ADR 0006. Decision recorded below; this issue can close once the ADR merges and #49/#50 bodies are updated.

Problem

ADR-0001 prefers a native-messaging wire and names the localhost port the rejected alternative (docs/adr/0001-dapp-connectivity-architecture.md:82-89, :148-152) — but the localhost wire is what shipped (#62/#63/#139/#141/#146/#148): a hand-rolled loopback HTTP server hardcoded to 127.0.0.1:8765. #49 (spike) was written to compare the two before any wire existed; #50 (PRD-04) specs the native-messaging end state. The plan and the shipped code disagreed, and no ADR recorded the shipped experimental wire.

Decision (2026-07-10)

Recorded in ADR 0006:

• Accept the shipped 127.0.0.1:8765 loopback bridge as the alpha transport — explicitly temporary/experimental. Do NOT invest heavily in hardening it now (no token auth / DNS-rebinding work beyond the existing loopback Host check).
• Native messaging stays the post-audit target (PRD-04 / Spike: Deckard-native dapp bridge (PRD-04 #1) #49 / PRD-04: Deckard-native bridge (universal reach, owned wire) #50), not the alpha's work.
• Priority = the two ends, not the pipe: deckard-core signing + the browser extension working and tested end-to-end. The transport is a swappable constraint we expect to replace.
• Acceptable only because the alpha is testnet-keys-only per SECURITY.md; does not survive real value.
• The connect-with-no-approval gap (eth_requestAccounts grants silently, lib.rs:228-238) is assigned to PRD-05: Per-origin permissions, registry & anti-phishing #48 (per-origin permissions & connect-time approval), not the alpha.
• Per-site revoke is a session-scoped disconnect, not a ban (Connections: daemon-held dapp sessions, listed in the app, revocable per site #199).

Remaining acceptance for this issue

• ADR merged (0006).
• Spike: Deckard-native dapp bridge (PRD-04 #1) #49 and PRD-04: Deckard-native bridge (universal reach, owned wire) #50 bodies updated to reference ADR 0006 (2026-07-13) (native messaging = post-audit target; localhost = interim, not the end state).
• The Epic: Dapp connectivity — own the transport (ADR 0001) #44 epic sequence reflects the decision (amendment section + interim-phase line added 2026-07-13).

[hellno]

All acceptance items done — closing.

• ADR 0006 merged via PR docs(bridge): #202 · ADR 0006 localhost transport + fix stale browser-bridge doc #220 (docs/adr/0006-localhost-dapp-bridge-transport.md).
• Spike: Deckard-native dapp bridge (PRD-04 #1) #49 and PRD-04: Deckard-native bridge (universal reach, owned wire) #50 now open with a re-scope note: the shipped 127.0.0.1:8765 loopback bridge is the temporary alpha transport; native messaging is the post-audit replacement, not the first wire.
• Epic: Dapp connectivity — own the transport (ADR 0001) #44 got an "Amendment (2026-07-10 — ADR 0006)" section, an interim-transport line in Phasing, and its stale pointer to the old spike branch now links the ADRs/research on main.