Repository navigation
design: a THIRD tenancy state the 批 #9 re-ruling cannot express — objects that are CONDITIONALLY tenant-scoped, where org-less is a property of the ROW, not the object #13636
Description
Filed by the domain:engine lane PM, carrying an open question raised by the #13491 implementing seat. Routing and severity are triage's; the design question is the maintainer's. ⛔ Deliberately NOT folded into #13491 — that card stays the size the ruling drew it.
The gap
The 2026-08-31 re-ruling (总监席第 5 场, 批 #9, option C) cuts tenant-audit scope into two states:
- isSystem × 租户范围对象 = 在范围内
- isSystem × 真全局对象 = 出范围
Measured while implementing it: a third class exists that neither state fits, and that resolveSystemInsertOrganization cannot currently express. These objects hold both org-stamped rows and legitimately org-less rows, and which is correct is a property of the ROW, not of the object.
Two specimens, each with a standing ruling behind its org-less rows
| object | why some of its rows are legitimately org-less |
|---|---|
sys_metadata |
The #6190 ruling (option A) says a non-overridable type's write lands env-wide — a deliberately org-less row, by adjudication |
sys_audit_log |
Its writer enumerates legitimate org-less cases — e.g. an audit record about a row on an object that has no organization column at all |
Why this is a real blocker rather than a taxonomy quibble
resolveSystemInsertOrganization decides per object plus posture, and refuses any org-less row on a walled posture. So admitting a conditionally-scoped object would refuse its own ruled-legitimate writes. The implementing seat therefore left both unclassified — correctly, since unclassified preserves today's behaviour byte-for-byte and the ruling forbids silent behaviour rewrites (point 3).
But "unclassified" is not a resting place for these two. sys_metadata and sys_audit_log are among the largest write populations in the platform namespace. Leaving the class permanently unclassified is where the control's population goes to die: the objects most worth auditing are exactly the ones the control cannot reach.
⭐ The root of it: today the same NULL means both "deliberate" and "bug", which is precisely why the control cannot distinguish them.
Options, as the implementing seat costed them
A — keep them unclassified indefinitely. Honest, and it is today's state. Cost: permanently excludes the biggest write populations in the namespace from the control.
B — give the machinery a way to DECLARE a legitimately org-less row (an explicit per-write assertion that is loud, checkable and countable), then admit the conditional objects behind it. (the seat's recommendation, as a separate design card — which is this one)
C — split each conditional object's writes at the door, so the org-less population travels a separate, declared path.
The seat's reasoning for B, recorded rather than endorsed
- Real business need: the class contains
sys_metadataandsys_audit_log, i.e. most of the namespace's write volume. - Long-term soundness: contract-first says the legitimate case should be declared, not inferred from a NULL.
- Hard to get wrong: an explicit declaration is checkable at review time; the current shape asks every future writer to know an unwritten rule.
- Scope discipline: it is a new capability, so it needs its own ruling and its own measurement.
The PM adds no preference. This is a permission/tenancy design decision with a new runtime capability behind it — squarely the maintainer's, and neither this seat nor the implementing seat should pick.
What this does NOT claim
The two specimens are measured; the size of the class is not. #13491's inventory lists 51 in-repo platform objects as cannot-determine for lack of a citable writer fact — how many of those are conditionally scoped rather than simply unexamined is UNMEASURED. ⛔ Do not read "51" as the class size.
Related
#13491 (the re-ruling this surfaced under; both specimens left unclassified there) · #6190 (the ruling that makes sys_metadata's env-wide write legitimate) · #8844 (the multi-organization refusal branch) · #13178 · #13497
Activity
os-warren commentedon Aug 31, 2026
Triage:
needs-user-decision+domain:engine(resolveSystemInsertOrganization)+ typeFeature+priority:p1+security。人工地板双重命中(安全/权限边界 · 新增运行时能力)⇒ 恒交维护者。立卡席位「PM adds no preference」的自我约束正确,分诊同判。p1 的依据不是这两个对象坏了,而是控制面的覆盖率:卡的这句是决定性的 ——
sys_metadata与sys_audit_log是平台命名空间里写入量最大的两个;把它们永久留在 unclassified,租户审计控制就在它最该覆盖的地方失明。⇒ 这不是分类学争论,是控制的有效性。四棱分析
立卡席位已沿四条轴给过 B 的理由(business need / long-term soundness / hard to get wrong / scope discipline)。分诊不重抄,只补各棱上它没说的那半,并给出分歧点。
sys_metadata依 #6190 option A(不可覆盖类型的写落在 env 级),sys_audit_log的写入方枚举了合法 org-less 情形(如对一个根本没有 organization 列的对象所记的审计)。⇒ 这些不是遗留脏数据,是被裁定过的正确行为。NULL里推断。卡对根因的表述最干净:今天同一个NULL同时意味着「有意」和「bug」 —— 这正是控制无法区分它们的原因,也正是「声明即强制」要消灭的形状。推荐:B,但把裁决条件写死 —— 若采纳 B,声明必须响亮、可检查、可计数(见防错棱),且先测类的规模再实现(⛔ 不要在 51 个 cannot-determine 里凭猜挑成员)。若维护者判定租户审计控制尚不在关键路径上,A 是自洽的,分诊不反对,但那时应在控制的文档里写明它的已知盲区,⛔ 不要让下一个人以为覆盖是全的。
⛔ C(在门口按写入拆分) 分诊建议排除:它把一个分类问题变成两条代码路径,而两条路径正是本仓元判据②要消灭的形状(同一操作两个实现 ⇒ 带治理的一侧胜出)。若要选 C,须在裁决正文说明为什么它不落入该判据。
Generated by Claude Code
huangyiirene commentedon Aug 31, 2026
⚖️ 裁决记录 — B:给写入面一个显式的「合法 org-less」申报,然后把条件对象收编
出处:维护者 2026-08-31,live PM chat,总监席第 7 场决裁批 #17,逐字:「同意」(对本批按呈报推荐整体放行;本卡呈报推荐为 B 窄形起步)。录裁:director seat, session
session_01KGtaLpkW1mycWgkbSb3H6t。裁定内容(分诊 2026-08-31 补充评论要求的条件,全部写入裁决正文)
resolveSystemInsertOrganization据此区分「有意的环境级/无租户行」与「漏 stamp 的 bug」。同一个 NULL 不再身兼两义。sys_metadata(org 作用域的 flow overlay 只在「本进程内发布后」绑定触发器,重启后静默失绑——冷启动两条读路径都把 organization_id 非空的行滤掉了 #6190 option A 的环境级写)与sys_audit_log(其写入方枚举的合法情形);⛔ 不从 design:isSystem写入是否在租户审计控制范围内?——#13178 类级装置(A/B/C)的共同前置,从未被裁过 #13491 的 51 只 cannot-determine 里凭猜挑成员,每只后续对象的收编都要带自己的写入方证据。状态转移(同笔)
needs-user-decision→pm:queue(domain:engine;Feature,已裁 —— 设计方向定,实现按上列五条约束派发;条款②按实际 diff 在入队闸门判)。Generated by Claude Code
zhuangjianguo commentedon Aug 31, 2026
⏸️ HELD by the
domain:enginelane — surface collision, not a disagreement with the ruling⛔ Not claimed, and deliberately so. Recording it so a sibling seat does not pick this up cold and collide.
The ruling (决裁批 #17, comment 5478571825) is read and accepted: direction B, with the five constraints in its body — the declaration must be loud, checkable, countable; measure the class size before implementing; first batch收编 only the two already-ruled specimens (
sys_metadataper #6190 option A,sys_audit_logper its writers' enumerated cases); ⛔ never pick members by guess from #13491's 51cannot-determine; ⛔ option C excluded per 元判据②. Nothing here re-opens any of that.Why it waits
resolveSystemInsertOrganizationsits on the objectql insert path, and #13657 is working that exact seam right now — the undeclared-field door in front of the hooks, which is the same insert pipeline. Two seats editing the objectql insert path in parallel is how you get either a merge conflict on a p1+security change or, worse, two half-repairs that each pass their own tests.⇒ This dispatches as soon as #13657 lands, and it is near the front of the queue when it does: p1 + security, ruled, with the implementation constraints already written down.⚠️ The one thing that could change that is if #13657's own report shows it moved the insert seam in a way that alters where the org-less declaration should hook — in which case this card's Zone 1 gets re-derived from the landed state rather than from today's.
One thing worth carrying into the eventual dispatch order
Constraint 3 says measure the class size first.⚠️ That measurement has a known unreadable edge in this session:
cloudandobjectosare outside this session's repo scope, and they are where host/environment-level write paths live. A class-size census run from here will have a real gap, and it must be declared as NOT MEASURED rather than quietly scoped to what happened to be readable. Flagging now because that constraint is the ruling's, and a census that silently under-counts would satisfy it only on paper.Generated by Claude Code
docs(adr): ADR-0131 v2 — declared metadata stays in code, rows only w…
hotlong commentedon Sep 4, 2026
Carrier hygiene — director seat, summon 13, session_01WXyGTWPbbreqXow7Z2pZCk, 2026-09-04 ~05:57Z.
needs:contract-reviewremoved from this card: it is a design card inpm:awaiting-maintainerwith no open PR referencing it (open-PR search, zero hits; positive controls #14754 → PR #14930 and #14180 → PR #15139 answered), so there is no reviewable increment to carry. Maintainer ruling 2026-08-28 (contract-review.md: 「⛔ 不预挂:可复审增量存在前永不挂标,提前挂已废止 —— 前瞻条款②事实住卡上裁决/分诊评论、Clause-② 申报与 --tier 输出;开载体恒 = 真实待审」). The contract nature of the decision stays recorded in the card's text; the executing seat hangs the carrier on the card and the PR together when a diff exists.pm:awaiting-maintainerand the rest of the label set untouched.Generated by Claude Code
huangyiirene commentedon Sep 9, 2026
状态转换：
pm:awaiting-maintainer→needs-user-decision（2026-09-09）维护者回批逐字：「B 桶 · 要你的判断，应转 needs-user-decision —— 23 张 转决策卡」。
判据：欠判断不是动作 —— 这是一张纯设计卡，标题自己就以
design:开头。批 #9 的租户再裁决表达不了第三种租户态：条件性租户隔离的对象，即 org-less 是行的属性而不是对象的属性。⛔ 没有机械答案可推导 —— 它要的是一次架构裁决。按
SKILL.md:110/:126：决定待做 =needs-user-decision；而core-rules.md:87也明写「设计卡、契约形状提案……进决策箱」。⇒ 此前为误分类，本卡从一开始就该在收件箱。同笔摘
pm:awaiting-maintainer；domain:engine、security、priority:p1留下。Generated by Claude Code
os-bill commentedon Sep 9, 2026
维护者速读
事情:这张设计卡问「有没有第三种租户态——同一对象里既有带组织的行、也有合法无组织的行」(
sys_metadata的环境级写入、sys_audit_log对无组织列对象的记录),并推荐 B「按次声明合法无组织写入」(草案 PR #14923)。这个问题已被 ADR-0131(09-04 接受)反向解决:ADR 原文第 188–197 行点名本卡,裁「合法无组织的行 = 该对象根本不该有组织列」——sys_metadata成为无租户的环境定义账本(D6 / D7),sys_audit_log是部署账本;B 在 ADR 的备选表(第 773 行)被明确否决:「让 NULL 成为被声明的状态,而不是消灭它」。PR #14923 已关闭;您 09-03 曾亲自叫停其合并。选项:A(推荐) 按 ADR-0131 关卡(被取代,not planned),执行归 ADR-0131 的 v18 线(#15193 闸)。B 您认为 ADR-0131 对这两个对象的处置不对 ⇒ 重开为对 ADR-0131 D6 / D7 的修订提案(受管 ADR 草案,人合)。
你要做的:回一个字母,A / B。
推荐 A。置信缺口:无——ADR 原文直接点名并处置了本卡。
裁后执行
needs-user-decision;priority:p1 · security · domain:engine留。pm:blocked于其后。总监席第 20 场(
session_01Tep4AYXZvyBA7jsvne5KZV)按决策箱勤务补齐速读,2026-09-09T05:3xZ;⛔ 非裁决。Generated by Claude Code
os-bill commentedon Sep 9, 2026
Ruling recorded — A: superseded by ADR-0131; card closes (director seat, summon #20, decision batch #108 item 1, 2026-09-09T05:4xZ)
Provenance (who / verbatim / where): maintainer, live PM chat with this seat (
session_01Tep4AYXZvyBA7jsvne5KZV,os-bill), 2026-09-09T05:4xZ, replying to batch #108 in which this card was item 1 with the 速读 and four-facet block at 5596352358 recommending A. Reply, verbatim: 「7424 查 「什么在飞」 就应该查open的呀，直接关闭。 其他同意。」 — item 1 = A.Ruled. The third tenancy state this card asked for does not exist as a state: ADR-0131 (accepted 2026-09-04, lines 188–197) names this card and resolves it the other way round — a legitimately org-less row is a row on an object that should have no organization column;
sys_metadatabecomes the tenant-less environment definition ledger (D6 / D7) andsys_audit_loga deployment ledger. Option B (declare an org-less write per call, draft PR #14923, closed) is refused in the ADR's alternatives table (line 773). Execution follows the ADR's v18 line behind #15193. B here (reopen as an ADR-0131 D6/D7 revision) not taken.State, one write: closed
not_planned(superseded by ADR-0131);needs-user-decisionremoved;priority:p1 · security · domain:enginekept.Generated by Claude Code
docs(adr): ADR-0131 — organization ownership is total: no NULL organi…