docs: update ADR-0064 and index to remove GraphQL references; clarify portal architecture

---

type: Decision Record

title: "ADR-0064: The portal is one container: a FastAPI backend that forwards calls and serves the built React app; no Next.js server, no GraphQL"

description: "The portal ships as one image. A Python/FastAPI backend serves the Vite-built React app at / and its own API at /api/*, so browser and API share one address. The backend forwards calls to OEG, Keycloak and AI² and merges nothing; there is no GraphQL layer."

title: "ADR-0064: The portal is one container: a FastAPI backend that forwards calls and serves the built React app; no Next.js server"

description: "The portal ships as one image. A Python/FastAPI backend serves the Vite-built React app at / and its own API at /api/*, so browser and API share one address. The backend forwards calls to OEG, Keycloak and AI² and merges nothing."

tags: [adr, portal, bff]

timestamp: 2026-10-08T00:00:00Z

status: "proposed"

## Context

[platform/architecture.md](/platform/architecture.md) describes the portal as a Next.js app with

a backend-for-frontend that stitches several backend APIs together through GraphQL. None of that

a backend-for-frontend that stitches several backend APIs together. None of that

was built:

- The GUI team moved the frontend from Next.js to a Vite React template.

Deferred or excluded:

- Merging data from several backends, GraphQL or otherwise.

- Merging data from several backends.

Revisit trigger:

* [ADR-0061](0061-use-short-execution-action-vocabulary.md) - proposed five-action vocabulary shared by the public SDK methods and supported_actions, with an explicit SRM intent mapping

* [ADR-0062](0062-zone-state-uses-camara-inactive.md) - `zone.state` uses CAMARA's `active`/`inactive`/`unknown` (was `offline`), so OEG passes the zone status filter and value through unmapped; domain, capability and control-path-binding states keep `offline`

* [ADR-0063](0063-callback-tokens-encrypted-in-oeg-db.md) - client callback tokens (EAM sinkCredential, QoD notificationAuthToken) are stored AES-GCM encrypted in oeg_db under one app-wide key; no key → 501; expired/revoked tokens are tombstoned and their deliveries skipped, never sent unauthenticated (amends ADR-0006's sink_credential_ref)

* [ADR-0064](0064-portal-is-one-container-with-a-thin-backend.md) - the portal is one image: a FastAPI backend serves the built React app at `/` and its API at `/api/*`, and forwards calls without merging data; no Next.js server, no GraphQL

* [ADR-0064](0064-portal-is-one-container-with-a-thin-backend.md) - the portal is one image: a FastAPI backend serves the built React app at `/` and its API at `/api/*`, and forwards calls without merging data; no Next.js server

* [ADR-0065](0065-portal-sessions-keyed-by-the-cookie.md) - portal login sessions live in PostgreSQL, tokens encrypted with a per-session key only the cookie holds; login attempts are single-use rows; a session lasts as long as Keycloak accepts its refresh token

* [ADR-0066](0066-api-clients-through-keycloak-client-registration.md) - developers' API clients are Keycloak clients registered by a narrow provisioner, products fixed at creation within the creator's grants, secret shown once, registration token encrypted under one app-wide key; a refused token on delete is reported; no reconciliation with Keycloak in Release 2

| SRM | Horizontal (stateless pods, shared PostgreSQL) | Database write throughput for order/inventory |

| TF-SDK | Scales with SRM (embedded library) | SBI HTTP call latency |

| FM | Horizontal (stateless FastAPI pods, shared PostgreSQL) | EWBI routing table lookup |

| Portal | Frontend via CDN; BFF horizontal | BFF concurrent connections |

| Portal | Frontend; BFF horizontal | BFF concurrent connections |

---