# ADR 0006: retire the 0.x adapters and gates

Status: accepted (2026-10-14)

## Decision

Remove: `server.py`, `server_entry.py`, `mcp_protocol.py`, `registry.py`,
`tools/*`, `policy.py` and `policy.yaml`, `authz.py`, `auth.py`, `oauth.py`,
`oauth_flow.py`, `automation.py`, `observability.py`, the API-key scripts, the
`[server]` extra, black and `requirements*.txt` (replaced by `uv.lock`).

Keep and adapt: `audit.py`, `security.py`, `response_limits.py`,
`request_context.py`, `errors.py`, `logging_utils.py`, `config.py`,
`rate_limit.py` (HTTP only), `scripts/validate_audit_log.py`.

## Rationale

The new catalog plus the SDK transports replace the adapters. The YAML policy
and resource-type gate existed to restrict a shared service PAT; per-user OAuth
now runs on the user's own token and the owner restricts admin mode with
`READ_ONLY`/`TOOLSETS`/`DISABLED_TOOLS`. Automation and metrics are outside an
API bridge's scope and were mostly scaffold. The release is a breaking 1.0.0.