> ## Documentation Index
> Fetch the complete documentation index at: https://prism.ntecdev.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# ADR-22: CORSMiddleware always mounted; cloud mode refuses non-https (modes named local/lan/cloud)

> Supersedes ADR-20. Same security decision, one naming correction: PRISM_MODE values are `local`, `lan`, `cloud`. All else stands: CORSMiddleware is always mount

<Info>**Status:** `accepted` · **ADR-22** · Filed 2026-04-19</Info>

## Decision

Supersedes ADR-20. Same security decision, one naming correction: PRISM\_MODE values are `local`, `lan`, `cloud`. All else stands: CORSMiddleware is always mounted in backend/app/main.py with allowed\_origins sourced from PRISM\_ALLOWED\_ORIGINS via the SPEC-019 v1.1 resolver; empty allowlist enforces default-deny (spec-compliant); cloud mode refuses to start if any origin uses plain http\://. Local mode's MODE\_PROFILES default is `http://127.0.0.1:*`.

## Rationale

Companion to ADR-21's rename. CORS decision unchanged; only the MODE\_PROFILES key name updates from `personal` to `local`. Per PRISM.md §A3 ADR immutability, supersede rather than edit. Filing alongside ADR-21 keeps the ADR chain coherent: ADR-19 -> ADR-21 and ADR-20 -> ADR-22 share the same rename driver.

## Alternatives Considered

(a) Edit ADR-20 in place: violates PRISM.md §A3. (b) File a single combined rename ADR: muddies traceability — ADR-19 and ADR-20 had distinct decision scopes (env resolver vs CORS policy); their supersessions should be distinct too.