Repository navigation
docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H) #24897
Description
Filing gate ③: a task the maintainer's rulings direct. The ADR notes the 18.x line owes are batched into one Tier H PR, which the maintainer merges (docs/adr/** is governed).
- Reader who acts: the epic seat (
epic:#15194). - Dedupe: none open. Searched "ADR-0131 dated note 18.x" (80 hits, all closed or unrelated).
What the notes must record (each one cites its source)
- Release scope. 18.0.0 published with steps 1–6 and step 7 parts 7a-1, 7a-3, 7b-3 and 7c. The rest of step 7 follows. Source: record 6291577585 on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194. This replaces ADR-0131's release-scope note (~817-830), which still says the ceremony comes in a later release.
- D9, the lean-embedding exception.
Engine.resolveSystemInsertOrganizationanswersno-organization-objectand stores NULL when the composition registers nosys_organization. The counter keeps__global__there (feat(cli,driver-sql)!: a tenant table's organization-less row no longer reaches the__global__counter, and a production server boot with no auth secret is refused (18.x step 7, part 7b-3) #24845). Productionos serverefuses a boot with no auth secret (feat(cli,driver-sql)!: a tenant table's organization-less row no longer reaches the__global__counter, and a production server boot with no auth secret is refused (18.x step 7, part 7b-3) #24845, under 把 public 从"全局开关的副产品"升级为声明式能力,然后删掉 api.requireAuth 开关 #3963 A1). Source: refactor(drivers,objectql,plugin-security)!: 18.x step 7: retire the organization-less readers (8c), COALESCE and __global__ (8d), and steps 1–3's dual reads #24583 reports 6284717698 and 6288405082. - D1 at the DDL. The tenant column is NOT NULL at createTable from 7b-0. 18.0.0-born databases and pre-existing shards and Turso remote stores keep the nullable column the ceremony could not tighten. Source: execution record 6285122667, plus 7b-0's measurement.
- D2, declared sharing rules. They are deployment-wide through a typed marker (
deploymentWide), the shape of the declared-webhook ruling A. Source: 6285122667, feat(plugin-sharing,plugin-approvals,metadata-protocol)!: 18.x step 7 part 7a-3 — the organization-less readers of sharing rules, approval units and the seed loader retire #24828. - D8's gate is implemented (
check-tenant-chokepointrefuses an IS NULL arm on a tenant column). Source: feat(scripts): check-tenant-chokepoint refuses an IS NULL arm on a tenant column, and shipped texts stop describing the retired arm (18.x step 7, part 7z) #24880. - The D7 attribution field (
sys_audit_log.tenant_id) keeps its NULL arm by design. Source: feat(driver-sql,objectql)!: a tenant-scoped read no longer answers a row with no organization (18.x step 7, part 7a-1) #24825 review 6287357347.
Lands after step 7 (#24583) has merged, so the notes describe shipped code.
Activity
objectstack-fleet commentedon Oct 20, 2026
Hold · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-20T14:50Z. The epic seat (epic:#15194) holds this card. It is not for another seat to claim.Blocked-by: #24583
The seat sorted the 18.x line's follow-ups. The cards that decide whether ADR-0131 is actually complete stay with the epic: #24897, #24919, #24883 and #24902. #24899 (security) is dispatched now. #24898 and #24900 stay in the shared queue. The maintainer agreed, verbatim: 「同意」.
When step 7 (#24583) closes, the seat dispatches:
objectstack-fleet commentedon Oct 22, 2026
Claim: epic seat round · 2026-10-22T00:06Z · releasing the epic's hold (6293731009): step 7 (#24583) is closed (6323222024) and both decisions it waited on are ruled (#25133 6328987873 A; #25134 6328195425 A)
Session:
session_01Y5583bs2RDd53MH6kM1ca3Account:
os-steve(the card's assignee)Branch:
claude/issue-24897-adr-0131-dated-notesWorktree: the cloud session's own checkout (
mode:cloud)Domain:
domain:specSeat:
epic:#15194File surface:
docs/adr/0131-total-organization-ownership-no-null-organization-id.mdonly: dated notes, plus the D1 paragraph [Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134 rules. This is a governed path, so the PR is Tier H.Container & model:
S,mode:cloud,model: TIER_DEFAULT. A governed path: the maintainer approves the PR (Tier H).Clause-②: no — ADR text that records shipped behaviour and rulings; no code
Responsibility: ADR-0131 still describes the pre-step-7 line (the release-scope note at ~817-830, D1's "no nullable tenant column anywhere") | none | reached by every reader of the ADR
Thread-read: 6293731009
Serial constraints cleared: the PR stays a draft, and is not enqueued until [Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere #25133's fix and [Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134's
os migrate planadvisory have merged. Each note then cites its merge commit.objectstack-fleet commentedon Oct 22, 2026
os-dev-report
{ "issue": 24897, "status": "done", "branch": "claude/issue-24897-adr-0131-dated-notes", "head": "9b6e4da77e (base origin/main 459afea1f6)", "pr": "https://github.com/objectstack-ai/objectstack/pull/25149", "session": "session_01UQCyrGmMy6kwav9XCzAuQ9", "premise_still_valid": true, "summary": "ADR-0131 now records the 18.x line as shipped. It touches one file, the claim's surface (6329368843): +176/-26. (1) D14's release-scope note is replaced: 18.0.0 (06cab4849a) carries steps 1-6, the walled lift #24667 and the open ceremony #24681 included, plus 7a-1, 7a-3, 7b-3 and 7c. 7a-2, 7b-0, 7b-1+7b-2 and 7z landed after the GA (6291577585, 6323222024). (2) A D9 note records the lean-embedding exception and its boundaries: 7b-0's NOT NULL (#24940 5e9b100743), and ruling 6328987873 A, which refuses every production os serve/os start that composes no organization object, cited as #25133 in flight. So only programmatic embedding and --dev keep the exception. (3) D1's text is the #25134 paragraph (ruling 6328195425 A). The accepted 2026-09-04 text is quoted in an Amended note, which also carries the ruling's bindings; the os migrate plan advisory is cited as #25134's execution in flight. A dated D1 note records NOT NULL at CREATE TABLE. (4) D2: deploymentWide (6285122667, #24828). (5) D8: the gate implemented (#24880, #25140). (6) D7: sys_audit_log.tenant_id keeps its NULL arm (6287357347 j.3). (7) D5: the last-admin guard (#25141 abc25a3536). (8) D8: the organizationOutOfWriteReach residue (6325596117 Q1 A). (9) D1: the organization delete under ruling B (#25016 688052e147). The status line gains one Amended (2026-10-22) entry. The PR stays a draft until #25133's fix and #25134's advisory merge; then the two in-flight citations become merge commits.", "tests": "No code changed, so no suite was run. Every cited PR was read as merged at its stated merge commit. Each code fact was read on origin/main 459afea1f6: the chokepoint gate's spellings and 'is not' exemption, isDeploymentWideSharingRule / SharingRuleRow.deploymentWide, ATTRIBUTION_PARTITION_COLUMNS, the driver's notNullable tenant column, and organizationOutOfWriteReach with the storage-routes comment. The four D7-note objects declare tenant:false at 06cab4849a.", "gates": "dispatch-gates --commands (derived from the diff) gave 20 commands; each ran with its exit captured before any pipe; --ran: 20 derived, 20 run, 0 NOT-MEASURED. First pass: check-adr-symbol-anchors exit 1 on a line-number anchor (storage-routes.ts:761), now fixed to symbol anchors; check:doc-formula-expressions exit 3 (@objectstack/formula unbuilt), exit 0 after the turbo build. check-governed-merges --branch origin/claude/issue-24897-adr-0131-dated-notes: GOVERNED, Tier H, docs/adr/** x1, 202 changed lines.", "mcp_calls": "5 GitHub MCP reads (issue_read get + get_comments on #24897, search_pull_requests, and two ToolSearch loads); claude-code-remote send_message to the seat (1, after this comment). Other reads were gh api repo-scoped GETs.", "api_writes": "2 through the fleet-write relay: pr_create #25149 (draft, assignee os-steve, label skip-changeset; read back identical, 4720 bytes), and this comment. git push is not a REST write.", "open_questions": [], "out_of_scope_findings": [ "carrier: none · ADR-0131 D6's 2026-10-19 note on sharing_rule regime C (ruling 6258883445) still ends 'it has not shipped'. Not checked against main, and outside the nine items. Noted in the PR's Acceptance notes." ], "deviations": "The first pushed commit (9b2ae461e8) carries a 'Refs #24897' line. It was pushed before pnpm install registered the pre-push hook. check:commit-card-trailers refused the same line on the second commit, which was reworded before it was pushed. The published commit was not rewritten. The PR body carries the card relation, and a squash takes its message from the body." }Generated by Claude Code
objectstack-fleet commentedon Oct 22, 2026
Seat note · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-22T00:58Z. PR #25149 merged as37ccd5f2cf: the maintainer, os-zhuang (GOVERNED_APPROVERS), approved it at 00:31Z and landed it at 00:43Z. That closed this card.What the merge carries:
Two notes describe rulings still being executed:
os migrate planadvisory.Each becomes true on
mainwhen its PR merges.One follow-up Tier H PR (
Part of #24897) will carry:The seat sends its approval request then.
objectstack-fleet commentedon Oct 22, 2026
Landed · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-22T09:27Z. The follow-up PR #25154 (Part of #24897) merged intomainasef2b46b524. The maintainer, os-zhuang (GOVERNED_APPROVERS), approved it at 09:19Z on its final headfdfbe4965dand queued it. ADR-0131's 18.x notes are complete.B4, both citations now merge commits:
ab488d9b7d): a production boot that composes no organization object is refused;6251f59051):os migrate planlists the tenant columns still nullable.No "in flight" remains in the ADR.
B1, B2, B3 and B6 (precision findings of the accuracy review 6329955338):
Housekeeping:
needs-user-decisionis removed from docs(adr): ADR-0131 18.x notes, review precision (B1–B3, B6) and the #25155 / #25179 citations (Tier H) #25154.