diff --git a/workplans/ADAPTIVE-WP-0009-tenancy-posture-alignment.md b/workplans/ADAPTIVE-WP-0009-tenancy-posture-alignment.md index 00f0cbd..680e9a7 100644 --- a/workplans/ADAPTIVE-WP-0009-tenancy-posture-alignment.md +++ b/workplans/ADAPTIVE-WP-0009-tenancy-posture-alignment.md @@ -42,42 +42,6 @@ rule that would catch a tier claiming isolation it cannot evidence. §11.3 requires the mapping be "recorded once when the tier is defined" — this repo owns tier definition, so this repo owns the recording surface. -## Draft-7 update (2026-08-17) - -Draft-7 (`net-kingdom` commit `357109b`) applies three more reviews — -`audit-core`, `railiance-platform`, `flex-auth` — for eleven changes. - -**Finding 6 is resolved. Withdraw it.** Decision 5.3 makes `n/a` an admissible, -conformant level, declared with a stated reason: "`P0` presupposes a database and -`R0` presupposes retained data". This is exactly what T01 needed and it arrived -from another repo's review. `tenancy.yaml` is also now the adopted convention for -the declaration (from `flex-auth`), carrying `current`, `target`, `reviewed`, -`gap`, `placement_exceptions`, `service_class`, per-path detail and — for a -provider — the §5.5 provider declaration. **T01 no longer proposes a format; it -fills in the one that exists.** - -**Findings 1, 2, 3, 4, 5 and 7 all still stand, and there is a reason.** §11 is -byte-identical across drafts 5, 6 and 7. Four repos have now reviewed and none -touched it, because §11 is the commercial section and this repo owns it. Nobody -else was going to find these. That raises the priority of T06 rather than -lowering it. - -**Every guessed posture has been too generous, on every repo that self-reported.** -`flex-auth` is `I1 A0 E2 P n/a R n/a` — `/v1/check` authenticates no caller, so -any workload with network reach can assert any subject and receive an -authoritative allow. `apps-pg` is `I0 A0 E0 P n/a R0`, where `R0` means no -backup configured at all. Combined with `tenant-engine` on SQLite, the -commercial read is blunt: **no tier can support an isolation, availability or -retention claim against the estate as it stands today.** Nothing is blocked -because nothing claims — but nothing is sellable either, and that is the fact a -tier author needs before drafting, not after. - -**Providers declare separately now (§5.5).** A provider states what it *makes -reachable*; `apps-pg` provides `P1` while its own `P` is `n/a`. A tier's -guarantee therefore depends on two declarations, not one — the provider's -reachability and the consuming service's own level. T02's constraint artifact -must reference both or it will validate against half the picture. - ## Draft-6 update (2026-08-17) The framework moved to **draft-6** (`net-kingdom` commit `2744ce7`) after this @@ -138,9 +102,7 @@ Findings 6–7 are new, from draft-6 itself. 5. **§8.3.1 constrains pricing design directly.** Co-residents are equal and no resource governor exists, so a performance-differentiated tier is unsellable below P2. This is a pricing-model validation rule, not only an ops fact. -6. **~~Off-ladder notation appears in a worked example.~~ RESOLVED in draft-7** - by Decision 5.3 (`n/a` is a level, and it is conformant). Kept for the record. - Draft-6 records +6. **Off-ladder notation appears in a worked example.** Draft-6 records `tenant-engine` as `P—` (still on SQLite, below P0's meaning) and `R0/R1` (a dual value). Neither is on any ladder. This is the same wall T01 hit from the other side: the ladders have no way to say *not on this axis at all*, so the @@ -269,28 +231,12 @@ availability** until finding 1 is resolved; say so rather than inventing a level `tenant-engine` owns which plan a tenant holds; this repo owns the terms — state that split when replying so the seam is recorded. -**Q2 — placement co-signature. Decided 2026-08-17 by Bernd: decline the -signature, bind via artifact instead.** - -adaptive-pricing publishes tier minimums as typed constraints (T02/T03) and asks -railiance-platform to validate placement against them. Ownership stays single; -the check runs every time rather than when someone remembers to route it. §8.2's -concern is right — placement decided purely on operational grounds does constrain -what can be sold — but a signature is the wrong instrument for a constraint that -is machine-checkable, and tier minimums are machine-checkable by construction. - -**No interim veto.** A scoped veto was considered and dropped: its only purpose -would be protecting existing claim-bearing tiers, and there are none. Not being -live is what makes the direct move safe. - -**Named revisit trigger** — if a tier carrying an isolation, availability or -retention claim is drafted before the constraint artifact lands, reopen this -decision rather than assume it. Declining must not be open-ended. - -Accept the P ladder, the triggers and §8.1's monitoring obligation -unconditionally. Caveat to raise: §8.1 says triggers MUST be monitored and never -says by whom; if that defaults to adaptive-pricing it is a standing obligation on -a repo with no on-call. Propose it is railiance-platform's. +**Q2 — placement co-signature.** Recommend **accepting, scoped**: co-signer means +a veto on placement policy changes that would invalidate an existing tier's +recorded minimum — not a seat in per-workload placement operations. §8.2's +reasoning holds and the stated alternative is real (placement decided purely on +operational grounds then constrains what can be sold), but unscoped co-signature +on an ops decision puts a commercial repo in a ticket queue. Bernd's call. Reply on the State Hub to message `6d5293ca-4f69-46a6-a78e-b469e626b83d`.