docs: consolidate oss-packages adrs

[joanagmaia]

This pull request replaces the previous ADR for the packages database with a new, comprehensive, and "living" architectural decision record (ADR-0001) that documents all major design decisions for the oss-packages domain. The new ADR consolidates database, ingestion, worker, and data ownership strategies into a single, continuously updated document, superseding the prior single-purpose ADR.

The most important changes are:

ADR and Documentation Overhaul:

• Added docs/adr/0001-oss-packages-design-decisions.md as the single living record for all design decisions in the oss-packages domain, covering database architecture, ingestion strategies, data ownership, and open questions.
• Removed the previous ADR, docs/adr/0001-packages-database.md, which focused only on the database separation decision, consolidating its content into the new, broader ADR.

Key Architectural and Process Decisions (as captured in the new ADR):

• Defined partitioning and placement for all major tables, including rationale and trade-offs for query performance and scalability.
• Standardized worker architecture and ingestion strategies for each data source (npm, Maven, GitHub, Docker Hub, OSV), including data flow, update cadence, and conflict-avoidance rules.
• Established explicit data ownership and provenance for all major tables and columns, with clear boundaries between sources and a process for handling schema evolution.
• Documented open questions and deferred decisions (e.g., critical vulnerability flag semantics, Sonatype API access), ensuring future changes are tracked in one place.

---

Note

Low Risk
Documentation-only change; no runtime, schema, or deployment behavior is modified.

Overview
Replaces two accepted ADRs (0001-packages-database, 0002-packages-worker-architecture) with a single living ADR-0001 that records the full oss-packages design in one place.

Beyond what the removed ADRs covered, the new doc adds universe/criticality (deps.dev BigQuery → packages_universe), concurrent write rules per table, repo provenance (package_repos, canonical URLs), OSV ingestion semantics, per-source npm/Maven/GitHub/Docker strategies, a deps.dev column ownership matrix, Tier 2 vs Tier 3 download storage, and an open questions section. docs/adr/README.md now indexes only this ADR.

^{Reviewed by Cursor Bugbot for commit 4567272. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[Copilot]

Pull request overview

Documentation-only reorganization that replaces two separate accepted ADRs (0001-packages-database.md, 0002-packages-worker-architecture.md) with a single living ADR consolidating all oss-packages design decisions (DB placement, worker architecture, ingestion strategies, write semantics, provenance, OSV, deps.dev ownership, downloads tiering, open questions). The ADR index is updated accordingly. No runtime code changes.

Changes:

• Add new consolidated living ADR docs/adr/0001-oss-packages-design-decisions.md.
• Delete docs/adr/0001-packages-database.md and docs/adr/0002-packages-worker-architecture.md.
• Update docs/adr/README.md index to reference only the new ADR.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
docs/adr/0001-oss-packages-design-decisions.md	New living ADR consolidating oss-packages design decisions.
docs/adr/0001-packages-database.md	Removed; content folded into new ADR.
docs/adr/0002-packages-worker-architecture.md	Removed; content folded into new ADR.
docs/adr/README.md	Index updated to list only ADR-0001 with living status.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.