[claude]

Summary

Before: the design decisions taken for the volunteer launch lived only in a Slack thread. The repo's ADR sequence stopped at 0033, so the canonical animal identifier was unnamed, the login page still advertised a password sign-in that invited volunteers cannot use, and it was not written down anywhere that nothing may run on an operator's laptop.

After: five scoped ADRs, 0034 through 0038, all marked accepted. Four record decisions taken on 2026-09-06; the fifth (0038, the engagement collector) records the design you chose on 2026-09-07. Docs only: no code, no config, and no existing ADR's substance is changed.

The five records

ADR	Title	Status
0034	Invite-only magic-link authentication for volunteer sign-in	accepted
0035	The shelter reference code is the canonical animal identifier	accepted
0036	Listing engagement data lives in the Pet Data service	accepted
0037	Hosted-only execution: nothing runs on an operator's machine	accepted
0038	Collect listing engagement with a scheduled Cloudflare Worker	accepted

0034 through 0037 are decisions you had already made, written down. 0038 was put to you as a design with one alternative (a saved third-party scraper profile that a human re-authenticates by hand); you chose the two-fetch Cloudflare Worker on 2026-09-07, so it is now accepted and the alternative is recorded as declined. One prerequisite is still yours to arrange: the aggregator credentials installed as Worker secrets.

Open questions the ADRs flag

• Identifier padding (0035). The animal schema documents an A-00000 shape; the aggregator's stats report printed the same code as a plain unpadded integer on 96 of 96 rows sampled on 2026-09-06. Whether the shelter system emits it padded or prefixed is unanswered. If it does, a canonical normalization is needed on both sides before any join is relied on; if it does not, the schema comment is stale. This needs a real shelter-system extract to settle.
• Where the grader's score records live (0036). Not decided. services/grader has no data layer yet. Putting score records in Pet Data would cut against ADR 0030's one-database-per-service rule; giving the grader its own database reopens the fourth-project question that 0036 declined for engagement.

Two follow-ups these ADRs record but do not perform

• docs/adr/README.md's index and its "0001-0032" range line do not cover 0033 or these five. Left untouched deliberately (this PR adds only new files); worth a separate housekeeping commit.
• ADR 0035 supplies the identifier that ADR 0033 promised but left unnamed. 0033 is not edited here; if you want that cross-reference in 0033 itself, that is a separate change.

Verified in the repo while writing these (with the citations in the ADRs)

• enable_signup = false at apps/stacker/supabase/config.toml lines 169, 204 and 255. Note the scope limit already recorded in apps/stacker/CLAUDE.md: config.toml governs local and self-hosted only, so the hosted project's setting is not verified.
• The admin stub is real: apps/stacker/src/routes/app/petdata/+layout.server.ts:7 and apps/stacker/src/routes/app/retriever/+layout.server.ts:7 both return isAdmin: true with a stub comment. ADR 0034 records this as a blocker before the first invite.
• The login page does render a password field (login/+page.svelte:49-58) backed by signInWithPassword (login/+page.server.ts:14). Not touched in this PR.
• One correction to how this was framed: the canonical identifier column petdata_animals.id is a String primary key, so it is non-null and indexed. The nullable, unindexed column on that table is the separate source_record_id. ADR 0035 states both accurately. What is true is that nothing populates the identifier in production: parse_animal_response has no caller outside unit tests.

Related issues

None.

Module(s) touched

• services/petdata
• services/retriever
• apps/stacker
• packages/ (design-system, auth, schema)
• docs/ or repo-level (CI, templates, ADRs)

Checklist

• Tests and lint pass locally for each touched module (no module touched; docs only, no test gate applies).
• Docs updated when behavior changed (no behavior changed; these ADRs are the doc change).
• No client names or branded SMS tool names introduced (checked: zero matches, and the listing aggregator is referred to generically throughout).
• No source research papers committed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Roo9YbNRZ1NBuACbKv33ky

---

Generated by Claude Code