[mickvandijke]

Adds ADR-0027 (Proposed): run every node identity on a machine inside one daemon. The identities share one process, one capacity budget per filesystem and one cache of chain facts. Between two daemons there is one connection, and each message names the identity it is for. Each identity keeps its own key, close group, stores, paid list and rewards address.

The ADR replaces the August prototype (feat/multi-identity-daemon here and in saorsa-core) rather than reviving it:

• It drops the prototype's SQLite lease catalogue and uses ADR-0014's file-per-chunk stores, one per identity.
• Peers trust a co-hosting statement only when both the identity and the daemon have signed it.
• The daemon's own key never joins the DHT.

Rollout has six stages. The first needs no transport change, since devnet already runs several nodes in one process.

This PR is docs only: no code changes.

Linear issue

No Linear issue has been identified for this work yet; a maintainer can add one.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Proposed; a human confirms at review. This PR is docs only. The work the ADR describes is T3, because it changes the wire protocol and routing.

Compatibility

• Wire: none (docs only)
• Storage: none (docs only)
• API: none (docs only)

Semver impact

• breaking
• feature
• fix

Docs only, so no crate changes, as in #213 and #236.

Test evidence

Docs only, so there is nothing to run. Where the ADR describes current behaviour, I checked it against ant-node main at 02c86824 and saorsa-core main:

• how a channel's peer identity is registered from signed messages;
• the transport's automatic identity announce, and DHT admission by the node/ user agent;
• the many-to-many maps between peers and channels;
• per-store capacity checks on a shared partition;
• the IP diversity limits;
• the process-wide traffic counters;
• devnet running several P2PNodes in one process.

I also reviewed the ADR for logical blockers, and folded the findings into the text.

New dependency

none

ADR

https://github.com/WithAutonomi/ant-node/blob/docs/adr-0027-node-daemon/docs/adr/ADR-0027-one-node-daemon-many-identities.md

Mitigation / rollback

Revert the commit. The ADR is only Proposed, and no code implements it.

🤖 Generated with Claude Code