tegwick
c1b60f322e
All checks were successful
Build and publish policy-nexus image / build-and-push (push) Successful in 1m10s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
284 lines
31 KiB
HTML
284 lines
31 KiB
HTML
<!doctype html>
|
|
<html lang="en"><meta charset="utf-8">
|
|
<meta name="policy-source-revision" content="f9435cd605cc5b3cb0f2e957ce6287d9f3129aac">
|
|
<meta name="policy-source-digest" content="f94f429c72f6cfd01ee83f1e5689d2d10ae52d7588d7cbd3ca40aca7eef46fb0">
|
|
<title>Federated Namespaces</title>
|
|
<style>
|
|
:root{
|
|
--paper:#EDEEF0; --surface:#F6F7F8; --surface-2:#E4E6E9;
|
|
--ink:#171D24; --ink-2:#4A5561; --ink-3:#737E8A;
|
|
--rule:#D3D7DC; --rule-strong:#B6BCC3;
|
|
--brass:#8A6A2E; --brass-soft:#EFE5CD; --brass-line:#C9AE74;
|
|
--clay:#8A3A2C; --clay-soft:#F2DFDA;
|
|
--l0:#DCE0E2; --l1:#B9C4C7; --l2:#8CA1A6; --l3:#567D84; --l4:#23555E;
|
|
--chip-fg:#F6F7F8;
|
|
--font-display:ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",sans-serif;
|
|
--font-body:"Iowan Old Style","Palatino Linotype",Palatino,Georgia,serif;
|
|
--font-mono:ui-monospace,"SF Mono","Cascadia Code",Menlo,Consolas,monospace;
|
|
--measure:66ch;
|
|
}
|
|
@media (prefers-color-scheme:dark){
|
|
:root:not([data-theme="light"]){
|
|
--paper:#12161A; --surface:#191E24; --surface-2:#222831;
|
|
--ink:#E6E9EC; --ink-2:#A3ADB7; --ink-3:#78838E;
|
|
--rule:#2A3138; --rule-strong:#3B444D;
|
|
--brass:#C9A45C; --brass-soft:#33290F; --brass-line:#6B5426;
|
|
--clay:#D08A76; --clay-soft:#3A211B;
|
|
--l0:#262C32; --l1:#35424A; --l2:#4A626B; --l3:#6A939D; --l4:#97C4CD;
|
|
--chip-fg:#12161A;
|
|
}
|
|
}
|
|
:root[data-theme="dark"]{
|
|
--paper:#12161A; --surface:#191E24; --surface-2:#222831;
|
|
--ink:#E6E9EC; --ink-2:#A3ADB7; --ink-3:#78838E;
|
|
--rule:#2A3138; --rule-strong:#3B444D;
|
|
--brass:#C9A45C; --brass-soft:#33290F; --brass-line:#6B5426;
|
|
--clay:#D08A76; --clay-soft:#3A211B;
|
|
--l0:#262C32; --l1:#35424A; --l2:#4A626B; --l3:#6A939D; --l4:#97C4CD;
|
|
--chip-fg:#12161A;
|
|
}
|
|
|
|
*{box-sizing:border-box}
|
|
body{
|
|
margin:0; background:var(--paper); color:var(--ink);
|
|
font-family:var(--font-body); font-size:17px; line-height:1.62;
|
|
-webkit-font-smoothing:antialiased;
|
|
}
|
|
.wrap{max-width:1180px;margin:0 auto;padding:0 24px 96px}
|
|
.layout{display:grid;grid-template-columns:180px minmax(0,1fr);gap:56px;align-items:start}
|
|
@media (max-width:960px){.layout{grid-template-columns:1fr;gap:0}.rail{display:none}}
|
|
|
|
/* ---------- rail ---------- */
|
|
.rail{position:sticky;top:28px;padding-top:8px;font-family:var(--font-display);font-size:12px;line-height:1.5}
|
|
.rail ol{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:7px}
|
|
.rail a{color:var(--ink-3);text-decoration:none;display:flex;gap:9px}
|
|
.rail a:hover,.rail a:focus-visible{color:var(--brass)}
|
|
.rail .n{font-family:var(--font-mono);font-size:10px;color:var(--rule-strong);min-width:16px;padding-top:1px}
|
|
.rail .grp{margin-top:14px;font-size:9.5px;letter-spacing:.14em;text-transform:uppercase;color:var(--rule-strong)}
|
|
|
|
/* ---------- header ---------- */
|
|
header{padding:64px 0 40px;border-bottom:2px solid var(--ink);margin-bottom:44px}
|
|
.eyebrow{font-family:var(--font-mono);font-size:11.5px;letter-spacing:.13em;text-transform:uppercase;color:var(--ink-3);display:flex;flex-wrap:wrap;gap:14px;margin-bottom:22px}
|
|
.eyebrow .stat{color:var(--clay)}
|
|
h1{font-family:var(--font-display);font-weight:800;letter-spacing:-.035em;line-height:.94;font-size:clamp(46px,9vw,92px);margin:0 0 6px;text-wrap:balance}
|
|
.sub{font-family:var(--font-display);font-weight:500;font-size:clamp(16px,2.4vw,21px);letter-spacing:-.01em;color:var(--ink-2);margin:0 0 30px;max-width:34ch;line-height:1.3}
|
|
.metagrid{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:20px 28px;border-top:1px solid var(--rule);padding-top:20px}
|
|
.metagrid dt{font-family:var(--font-mono);font-size:10px;letter-spacing:.13em;text-transform:uppercase;color:var(--ink-3);margin-bottom:5px}
|
|
.metagrid dd{margin:0;font-family:var(--font-display);font-size:13.5px;line-height:1.45;color:var(--ink)}
|
|
|
|
/* ---------- typography ---------- */
|
|
section{margin-bottom:60px;scroll-margin-top:24px}
|
|
h2{font-family:var(--font-display);font-weight:750;letter-spacing:-.022em;font-size:clamp(24px,3.4vw,31px);line-height:1.12;margin:0 0 18px;text-wrap:balance;display:flex;gap:14px;align-items:baseline}
|
|
h2 .sn{font-family:var(--font-mono);font-size:12px;font-weight:400;color:var(--brass);letter-spacing:.06em;flex:none;padding-top:2px}
|
|
h3{font-family:var(--font-display);font-weight:700;font-size:16px;letter-spacing:-.008em;margin:34px 0 10px;color:var(--ink)}
|
|
p{margin:0 0 15px;max-width:var(--measure)}
|
|
ul,ol{max-width:var(--measure);margin:0 0 15px;padding-left:20px}
|
|
li{margin-bottom:7px}
|
|
strong{font-weight:600}
|
|
em{font-style:italic}
|
|
code{font-family:var(--font-mono);font-size:.855em;background:var(--surface-2);padding:1px 5px;border-radius:2px}
|
|
a{color:var(--brass)}
|
|
.lede{font-size:19px;line-height:1.55;color:var(--ink-2);max-width:60ch}
|
|
|
|
/* ---------- devices ---------- */
|
|
.callout{border-left:3px solid var(--brass);background:var(--brass-soft);padding:18px 22px;margin:0 0 24px;max-width:var(--measure)}
|
|
.callout p:last-child{margin-bottom:0}
|
|
.callout .lbl{font-family:var(--font-mono);font-size:10px;letter-spacing:.13em;text-transform:uppercase;color:var(--brass);display:block;margin-bottom:8px}
|
|
.rule-quote{border-top:2px solid var(--ink);border-bottom:2px solid var(--ink);padding:26px 0;margin:28px 0;max-width:var(--measure)}
|
|
.rule-quote p{font-family:var(--font-display);font-weight:600;font-size:19px;line-height:1.38;letter-spacing:-.014em;margin:0;text-wrap:balance}
|
|
.hard{border-left:3px solid var(--clay);background:var(--clay-soft);padding:18px 22px;margin:0 0 24px;max-width:var(--measure)}
|
|
.hard .lbl{font-family:var(--font-mono);font-size:10px;letter-spacing:.13em;text-transform:uppercase;color:var(--clay);display:block;margin-bottom:8px}
|
|
.hard p:last-child{margin-bottom:0}
|
|
.dec{font-family:var(--font-mono);font-size:10.5px;letter-spacing:.08em;color:var(--brass);text-transform:uppercase}
|
|
.vec{font-family:var(--font-mono);font-size:.9em;font-weight:600;background:var(--surface-2);padding:2px 7px;border-radius:2px;white-space:nowrap;letter-spacing:.04em}
|
|
|
|
/* ---------- tables ---------- */
|
|
.scroll{overflow-x:auto;margin:0 0 24px;-webkit-overflow-scrolling:touch}
|
|
table{border-collapse:collapse;width:100%;min-width:520px;font-family:var(--font-display);font-size:13.5px;line-height:1.45}
|
|
th{text-align:left;font-family:var(--font-mono);font-size:9.5px;letter-spacing:.13em;text-transform:uppercase;color:var(--ink-3);font-weight:400;padding:0 16px 8px 0;border-bottom:1px solid var(--rule-strong);vertical-align:bottom}
|
|
td{padding:11px 16px 11px 0;border-bottom:1px solid var(--rule);vertical-align:top;color:var(--ink-2)}
|
|
td:first-child{color:var(--ink);font-weight:600}
|
|
tbody tr:last-child td{border-bottom:none}
|
|
.lvl{font-family:var(--font-mono);font-weight:600;font-size:12px;letter-spacing:.04em;color:var(--ink)}
|
|
|
|
/* ---------- ladders ---------- */
|
|
.breakout{margin:34px 0 40px}
|
|
.bhead{display:flex;justify-content:space-between;align-items:baseline;gap:20px;border-bottom:1px solid var(--rule-strong);padding-bottom:9px;margin-bottom:22px;flex-wrap:wrap}
|
|
.bhead h3{margin:0;font-size:13px;letter-spacing:.1em;text-transform:uppercase;font-family:var(--font-mono);font-weight:400;color:var(--ink-3)}
|
|
.bhead .note{font-family:var(--font-display);font-size:12.5px;color:var(--ink-3)}
|
|
.ladders{display:grid;gap:26px}
|
|
.ladder{display:grid;grid-template-columns:126px minmax(0,1fr);gap:18px;align-items:start}
|
|
@media (max-width:700px){.ladder{grid-template-columns:1fr;gap:10px}}
|
|
.ladder .pname{font-family:var(--font-display);font-weight:700;font-size:14px;letter-spacing:-.01em;padding-top:2px}
|
|
.ladder .pname span{display:block;font-family:var(--font-mono);font-size:10px;font-weight:400;letter-spacing:.1em;text-transform:uppercase;color:var(--ink-3);margin-top:3px}
|
|
.rungs{display:grid;gap:3px;grid-template-columns:repeat(5,minmax(0,1fr))}
|
|
@media (max-width:700px){.rungs{grid-template-columns:repeat(2,minmax(0,1fr))}}
|
|
.rung{padding:9px 10px 11px;background:var(--surface);border-top:4px solid var(--l0);min-width:0}
|
|
.rung.r1{border-top-color:var(--l1)} .rung.r2{border-top-color:var(--l2)}
|
|
.rung.r3{border-top-color:var(--l3)} .rung.r4{border-top-color:var(--l4)}
|
|
.rung .code{font-family:var(--font-mono);font-size:11px;font-weight:600;letter-spacing:.06em;color:var(--ink);display:block;margin-bottom:4px}
|
|
.rung .txt{font-family:var(--font-display);font-size:11.5px;line-height:1.34;color:var(--ink-2);display:block}
|
|
.rung.na{opacity:.42}
|
|
|
|
/* ---------- matrix ---------- */
|
|
.matrix-shell{display:grid;grid-template-columns:auto minmax(0,1fr);gap:12px;align-items:stretch;margin-bottom:14px}
|
|
.ylab{writing-mode:vertical-rl;transform:rotate(180deg);font-family:var(--font-mono);font-size:9.5px;letter-spacing:.14em;text-transform:uppercase;color:var(--ink-3);text-align:center;padding-bottom:22px}
|
|
.mgrid{display:grid;grid-template-columns:34px repeat(5,minmax(0,1fr));gap:3px}
|
|
.mcell{background:var(--surface);min-height:60px;padding:6px;display:flex;flex-direction:column;justify-content:flex-end;gap:4px;min-width:0}
|
|
.mcell.tint1{background:color-mix(in srgb,var(--l1) 26%,var(--surface))}
|
|
.mcell.tint2{background:color-mix(in srgb,var(--l2) 26%,var(--surface))}
|
|
.mcell.tint3{background:color-mix(in srgb,var(--l3) 24%,var(--surface))}
|
|
.mcell.tint4{background:color-mix(in srgb,var(--l4) 22%,var(--surface))}
|
|
.mcell.void{background:repeating-linear-gradient(135deg,transparent,transparent 5px,var(--rule) 5px,var(--rule) 6px);opacity:.55}
|
|
.rlab,.clab{font-family:var(--font-mono);font-size:10px;font-weight:600;letter-spacing:.05em;color:var(--ink-3);display:flex;align-items:center;justify-content:center}
|
|
.rlab{min-height:60px}
|
|
.clab{padding-top:7px;min-height:22px}
|
|
.pin{font-family:var(--font-mono);font-size:9.5px;font-weight:600;letter-spacing:.02em;background:var(--ink);color:var(--paper);padding:2px 5px;border-radius:2px;line-height:1.3;display:block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
|
|
.pin.ghost{background:transparent;color:var(--ink-2);border:1px dashed var(--rule-strong)}
|
|
.mnote{display:flex;gap:22px;flex-wrap:wrap;font-family:var(--font-display);font-size:12px;color:var(--ink-3);padding-top:6px}
|
|
.mnote .k{display:flex;align-items:center;gap:7px}
|
|
.sw{width:13px;height:13px;flex:none;background:var(--ink)}
|
|
.sw.g{background:transparent;border:1px dashed var(--rule-strong)}
|
|
.sw.v{background:repeating-linear-gradient(135deg,transparent,transparent 4px,var(--rule) 4px,var(--rule) 5px);border:1px solid var(--rule)}
|
|
@media (max-width:640px){
|
|
.mgrid{grid-template-columns:28px repeat(5,minmax(0,1fr))}
|
|
.mcell{min-height:52px;padding:4px}
|
|
.pin{font-size:8px;padding:1px 3px}
|
|
.rlab{min-height:52px}
|
|
}
|
|
|
|
/* ---------- methodology ---------- */
|
|
.verbs{display:grid;grid-template-columns:repeat(auto-fit,minmax(210px,1fr));gap:2px;background:var(--rule);border:1px solid var(--rule)}
|
|
.verb{background:var(--surface);padding:18px 18px 20px}
|
|
.verb h4{font-family:var(--font-display);font-weight:750;font-size:15px;margin:0 0 7px;letter-spacing:-.01em}
|
|
.verb p{font-family:var(--font-display);font-size:12.5px;line-height:1.46;color:var(--ink-2);margin:0;max-width:none}
|
|
.verb .step{font-family:var(--font-mono);font-size:9.5px;letter-spacing:.13em;color:var(--brass);display:block;margin-bottom:9px}
|
|
|
|
/* ---------- questions ---------- */
|
|
.qs{display:flex;flex-direction:column;gap:0;border-top:1px solid var(--rule-strong)}
|
|
.q{display:grid;grid-template-columns:34px minmax(0,1fr) 170px;gap:18px;padding:16px 0;border-bottom:1px solid var(--rule);align-items:start}
|
|
@media (max-width:760px){.q{grid-template-columns:28px minmax(0,1fr);gap:12px}.q .owner{grid-column:2}}
|
|
.q .qn{font-family:var(--font-mono);font-size:11px;color:var(--brass);padding-top:3px}
|
|
.q .qt{font-family:var(--font-display);font-size:14px;line-height:1.48;color:var(--ink-2)}
|
|
.q .qt b{color:var(--ink);font-weight:700;display:block;margin-bottom:2px;font-size:14.5px}
|
|
.owner{font-family:var(--font-mono);font-size:10px;letter-spacing:.05em;color:var(--ink-3);padding-top:4px}
|
|
.owner .tag{display:inline-block;border:1px solid var(--rule-strong);padding:2px 7px;border-radius:2px}
|
|
.owner .tag.need{border-color:var(--clay);color:var(--clay)}
|
|
|
|
/* ---------- misc ---------- */
|
|
.numbers{font-family:var(--font-mono);font-size:12.5px;line-height:1.85;background:var(--surface);border-left:3px solid var(--l3);padding:16px 20px;margin:0 0 22px;overflow-x:auto;max-width:var(--measure)}
|
|
.numbers .v{color:var(--ink);font-weight:600}
|
|
.numbers .k{color:var(--ink-3)}
|
|
pre{font-family:var(--font-mono);font-size:12.5px;line-height:1.68;background:var(--surface);border-left:3px solid var(--rule-strong);padding:16px 20px;overflow-x:auto;margin:0 0 22px;max-width:var(--measure);color:var(--ink-2)}
|
|
.alt{border-bottom:1px solid var(--rule);padding:14px 0;max-width:var(--measure)}
|
|
.alt:last-of-type{border-bottom:none}
|
|
.alt b{font-family:var(--font-display);font-size:14px;display:block;margin-bottom:3px}
|
|
.alt p{font-size:14.5px;margin:0;color:var(--ink-2)}
|
|
.alt .verdict{font-family:var(--font-mono);font-size:10px;letter-spacing:.1em;text-transform:uppercase;color:var(--clay)}
|
|
footer{border-top:2px solid var(--ink);margin-top:20px;padding-top:22px;font-family:var(--font-mono);font-size:11px;letter-spacing:.06em;color:var(--ink-3);display:flex;justify-content:space-between;gap:20px;flex-wrap:wrap}
|
|
.tm td,.tm th{text-align:center}
|
|
.tm td:first-child,.tm th:first-child{text-align:left}
|
|
.yes{color:var(--l4);font-weight:700}
|
|
.no{color:var(--clay);font-weight:700}
|
|
.kind{font-family:var(--font-mono);font-size:9px;letter-spacing:.09em;text-transform:uppercase;padding:2px 6px;border-radius:2px;white-space:nowrap;border:1px solid var(--rule-strong);color:var(--ink-3)}
|
|
.kind.adv{border-color:var(--clay);color:var(--clay)}
|
|
.routes{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:2px;background:var(--rule);border:1px solid var(--rule);margin:0 0 22px}
|
|
.route{background:var(--surface);padding:16px 18px}
|
|
.route h4{font-family:var(--font-display);font-weight:750;font-size:14px;margin:0 0 6px}
|
|
.route p{font-family:var(--font-display);font-size:12.5px;line-height:1.45;color:var(--ink-2);margin:0;max-width:none}
|
|
.route .tag{font-family:var(--font-mono);font-size:9px;letter-spacing:.1em;text-transform:uppercase;color:var(--brass);display:block;margin-bottom:8px}
|
|
a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-offset:3px}
|
|
@media (prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}}
|
|
|
|
</style>
|
|
<div class="wrap"><header><div class="eyebrow"><span>CUST-ADR-011</span> <span class="stat">proposed · draft-2</span> <span>the-custodian</span> <span>reviewed 2026-08-17</span><span>generated from canonical source — do not edit</span></div><h1>Federated Namespaces</h1><p class="sub">Source: <code>the-custodian · canon/architecture/adr-011-federated-namespaces-and-reconciliation-limits.md · f9435cd605cc5b3cb0f2e957ce6287d9f3129aac</code></p><p class="sub">Review due: 2027-02-17</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#status"><span class="n">·</span>Status</a></li><li><a href="#context"><span class="n">·</span>Context</a></li><li><a href="#decision"><span class="n">·</span>Decision</a></li><li><a href="#reconciliation-tiers-and-where-automation-stops"><span class="n">·</span>Reconciliation tiers, and where automation stops</a></li><li><a href="#consequences"><span class="n">·</span>Consequences</a></li><li><a href="#open-question"><span class="n">·</span>Open question</a></li><li><a href="#references"><span class="n">·</span>References</a></li></ol></nav><main><section id="status"><h2>Status</h2>
|
|
<p>Proposed, draft-2. Amends <code>ADR-007</code> decisions 1 and 2; extends <code>ADR-010</code> decision 4; adopts the plane/ladder/posture form and the accuracy-not-altitude conformance rule from <code>ADR-008</code> (Multi-Tenancy Framework).</p>
|
|
</section>
|
|
<section id="context"><h2>Context</h2>
|
|
<p>The ecosystem must be <strong>federation-capable</strong> — able to work without a live link to central services — and <strong>chain-of-command efficient</strong>. <code>federated-organization-standard_v1.0</code> already resolves the organizational half:</p>
|
|
<div class="rule-quote"><p>global coherence is achieved through policy, escalation, and shared protocols rather than through monolithic control (<code>:51</code>) bounded autonomy plus disciplined coordination (<code>:86</code>)</p></div>
|
|
<p>Authority is a <strong>policy</strong> layer; availability is a <strong>mechanism</strong>. Distributed version control makes the same separation: an integration branch is privileged by agreement, never by a technical property.</p>
|
|
<p><strong>One accepted decision violates this.</strong> <code>ADR-007</code> decision 1 requires running numbers that are <em>globally</em> unique and allocated forward only. Global sequential allocation requires a coordinator — precisely the central dependency federation must survive. Two disconnected forks each allocating <code>RCLUSTER-WP-0015</code> is a certainty, not an edge case.</p>
|
|
<p>This is not hypothetical. Instance-per-client tenancy (<code>CUST-WP-0058</code>) already makes every client deployment a fork of the stack; the business model committed to forking before the identifier scheme could express it.</p>
|
|
<h3>Why this draft changed form</h3>
|
|
<p>Draft-1 stated federation as a set of binary rules — notably "records fork, effects do not". That is a single verdict where a graduated declaration belongs, and it is the same conflation <code>ADR-008</code> §03 diagnoses for multi-tenancy: <em>"'Is this multi-tenant?' is treated as one question. It is four, and they are independent."</em></p>
|
|
<p>"Is this federation-capable?" is likewise not one question. A namespace can be strong on identity and incapable of disconnected operation; it can operate disconnected and have no way to reconcile afterwards. Draft-1 could not say so.</p>
|
|
<p>This draft reuses <code>ADR-008</code>'s vocabulary rather than inventing a parallel one. Two competing maturity vocabularies in one canon would be its own collision.</p>
|
|
</section>
|
|
<section id="decision"><h2>Decision</h2>
|
|
<p><strong>1. Records live in a namespace.</strong> A namespace is a federated branch of the ecosystem — a fleet instance, a client deployment, an autonomous domain that may operate disconnected. It is the unit of sovereignty in FOS terms and the unit of divergence here.</p>
|
|
<p><strong>2. Federation is four orthogonal planes.</strong></p>
|
|
<div class="scroll"><table><thead><tr><th>Plane</th><th>Question</th><th>Vocabulary owner</th></tr></thead><tbody><tr><td>Namespace <strong>N</strong></td><td>How are records named and disambiguated across branches?</td><td>this ADR</td></tr><tr><td>Autonomy <strong>U</strong></td><td>Can work proceed with no link to central services?</td><td>repo-manager</td></tr><tr><td>Reconciliation <strong>R</strong></td><td>What happens when branches meet again?</td><td>repo-manager</td></tr><tr><td>Substrate <strong>S</strong></td><td>Does this namespace hold independently diverging operational state?</td><td>railiance-platform</td></tr></tbody></table></div>
|
|
<p><strong>3. Each plane carries a ladder.</strong> Higher is stronger, not better. The right level is the one a namespace can evidence and its risk warrants.</p>
|
|
<pre>N0 no namespace concept; identifiers assume one global space
|
|
N1 namespace implied by deployment, never recorded
|
|
N2 namespace declared; identifiers namespace-scoped; qualification available
|
|
N3 N2 + lineage recorded, and derived identifiers keyed on (namespace, identifier)
|
|
|
|
U0 routine work requires the central service
|
|
U1 degraded read-only; writes blocked while disconnected
|
|
U2 work proceeds locally: file-derived state written to files, hub-native buffered
|
|
U3 U2 + exercised — a dated disconnection drill with evidence
|
|
|
|
R0 no defined path; divergence is unrecoverable
|
|
R1 manual, per-record comparison and hand resolution
|
|
R2 append-only events plus derived state: union and re-derive, deterministic
|
|
R3 R2 + lineage-aware; distinguishes divergence from collision automatically
|
|
|
|
S0 shares operational substrate with another namespace — cannot fork safely
|
|
S1 shared substrate, namespace-keyed
|
|
S2 dedicated substrate, no independent state divergence yet
|
|
S3 independent operational substrate with diverged state — the fork is real</pre>
|
|
<p><strong>4. A namespace declares a posture vector</strong>, in the repository rather than the hub, consistent with <code>ADR-010</code> decision 4 (file-derived state) and <code>ADR-008</code> decision 5.1.</p>
|
|
<pre>federation:
|
|
current: { N: 1, U: 1, R: 1, S: 1 }
|
|
target: { N: 3, U: 2, R: 2, S: 1 }
|
|
reviewed: "2026-08-18"
|
|
gap:
|
|
U: "Registration requires the registrar under ADR-007 decision 2 interim.
|
|
Lifts when derived identifiers land (RMGR-WP-0005-T03)."</pre>
|
|
<p><strong>The ecosystem's own posture today is <code>N1 U1 R1 S1</code></strong> — one implied namespace, disconnected registration blocked, reconciliation manual, substrate shared. Declaring that is conformant. Claiming better is not.</p>
|
|
<p><strong>5. Conformance is accuracy, not altitude.</strong> Adopted verbatim in force from <code>ADR-008</code> §06: a namespace is conformant when its declared posture is accurate, its target recorded, and it claims no level it cannot evidence. It is non-conformant when it overclaims, at any altitude.</p>
|
|
<p>Declaring <code>S0</code> is conformant. Concealing <code>S0</code> is not. A repository may join at any posture; it may not join silently. This matters more here than it does for tenancy: the cost of discovering a true posture during reconciliation is the whole difference between T2 and T3.</p>
|
|
<p><strong>6. Identifiers are unique within a namespace, qualified across.</strong> <code>ADR-007</code> decision 1 is amended: uniqueness and forward-only allocation are <strong>namespace-scoped</strong>. Global identity is the pair <code>(namespace, identifier)</code>.</p>
|
|
<pre>RCLUSTER-WP-0015 this namespace — the common case, unchanged
|
|
RCLUSTER-WP-0015@railiance01 a foreign namespace, explicitly qualified</pre>
|
|
<p>Unqualified always means "in my own namespace", exactly as <code>main</code> does against <code>origin/main</code>. A suffix preserves existing sorting, grep, and tooling; a prefix would break them.</p>
|
|
<p><strong>7. Derived identifiers key on the pair.</strong> <code>ADR-007</code> decision 2 (C2) derives UUIDv5 from the identifier. Under federation the input must be <code>(namespace, identifier)</code>. Deriving from the identifier alone would make two forks holding unrelated work under the same number compute the <em>same</em> UUID — a collision manufactured by the fix. C2 is not yet built, so this is free now and expensive later.</p>
|
|
<p><strong>8. The planes couple at their upper levels. State the coupling; do not use it to argue the planes are one.</strong></p>
|
|
<ul><li><code>R3</code> requires <code>N3</code> — distinguishing divergence from collision requires lineage.</li><li>A namespace may not sustain <code>U2</code> or above while below <code>R2</code>. Operating disconnected without deterministic reconciliation accumulates divergence that cannot later be merged. Autonomy without reconciliation is not federation; it is an unplanned fork.</li><li><code>T3</code> is entailed by <code>S3</code> in any participant (decision 10).</li></ul>
|
|
<p><strong>9. Anti-overclaim.</strong> This is the most misusable fact in the framework, and it is the direct analogue of <code>ADR-008</code>'s <code>P0 → P1 → P2</code> warning.</p>
|
|
<div class="rule-quote"><p>Adopting namespace-qualified identifiers is movement on the <strong>N plane only</strong>. It buys disambiguation, citability, and coordinator-free allocation. It does <strong>not</strong> raise autonomy, reconciliation, or substrate independence by one step. A system at <code>N3 U0 R0 S0</code> cannot operate disconnected and cannot reconcile.</p></div>
|
|
<p>No namespace may be described as "federation-capable", "independently operable", or "able to run disconnected" on N-plane evidence alone. Such a claim requires declared <code>U</code> and <code>R</code> levels with evidence behind them.</p>
|
|
<p><strong>Commercially</strong>, client-facing claims about instance independence must cite the <code>S</code> and <code>U</code> levels, never the identifier scheme. Instance-per-client tenancy is sold on substrate independence; the qualifier does not supply it.</p>
|
|
<p><strong>10. The reconciliation tier is derived from participants' postures, not judged after the fact.</strong></p>
|
|
<pre>any participant at S3 -> T3 (regardless of other planes)
|
|
all participants S<=S2 and R>=R2 -> T2 feasible
|
|
any participant below R2 -> T1 at best; manual thereafter</pre>
|
|
<p>This is the practical payoff of declaring postures: the cost of rejoining is <strong>computable before a fork is created</strong>, rather than discovered when reconciliation is attempted.</p>
|
|
<p><strong>11. Coexistence is the normal case; merging is the exception.</strong> The qualifier is primarily a coexistence mechanism, not merge preparation. Most forks — client instances above all — are never intended to return. Permanent parallel operation is a first-class outcome, not a failure to reconcile.</p>
|
|
<p><strong>12. Evidence.</strong> A claimed level requires evidence, per <code>ADR-008</code> §13.</p>
|
|
<div class="scroll"><table><thead><tr><th>Level</th><th>Evidence</th></tr></thead><tbody><tr><td><code>N2</code></td><td>namespace declared in the repo; qualified references resolve</td></tr><tr><td><code>N3</code></td><td>lineage fields present; a derived identifier reproduced by an independent implementation</td></tr><tr><td><code>U2</code></td><td>work completed with central unreachable, committed, later accepted without rework</td></tr><tr><td><code>U3</code></td><td>dated disconnection drill record</td></tr><tr><td><code>R2</code></td><td>replaying the union of events reproduces identical derived state</td></tr><tr><td><code>R3</code></td><td>a collision and a divergence, correctly distinguished, in test</td></tr><tr><td><code>S2</code> / <code>S3</code></td><td>substrate inventory naming the stateful systems and whether their state has diverged</td></tr></tbody></table></div>
|
|
<p><strong>13. Guard.</strong> Declared postures regress silently. Posture is checked by the same consistency machinery that checks repository standards (<code>RMGR-WP-0004-T02</code>, <code>rmgr conform</code>), so a namespace that drops below its declared level is a reported defect rather than a discovery. A regression found by guarding is a defect; a regression declared in advance is a decision.</p>
|
|
</section>
|
|
<section id="reconciliation-tiers-and-where-automation-stops"><h2>Reconciliation tiers, and where automation stops</h2>
|
|
<div class="scroll"><table><thead><tr><th>Tier</th><th>Situation</th><th>Mechanism</th><th>Automatable</th></tr></thead><tbody><tr><td><strong>T0 Fork</strong></td><td>namespace created, lineage recorded</td><td>metadata</td><td>yes</td></tr><tr><td><strong>T1 Sync</strong></td><td>pull canon, plans, or knowledge from another namespace</td><td>append events, re-derive</td><td>largely</td></tr><tr><td><strong>T2 Reintegration</strong></td><td>records diverged, no participant above <code>S2</code></td><td>union events, re-derive, human-resolve genuine contradictions</td><td>partly</td></tr><tr><td><strong>T3 Amalgamation</strong></td><td>any participant at <code>S3</code></td><td>governed programme — see below</td><td><strong>no</strong></td></tr></tbody></table></div>
|
|
<p><strong>T3 is not a merge.</strong> It resembles the merger or acquisition of distinct companies far more than a version-control merge, and must be planned as such:</p>
|
|
<ul><li>due diligence — inventory both sides, item by item;</li><li>survivor decisions per subsystem — keep, move, replace, retire;</li><li>migration with evidence, and decommissioning of what does not survive;</li><li>governance integration — reconciling two bodies of canon is a human act, never automated;</li><li>identity, credential, and data custody consolidation.</li></ul>
|
|
<p><strong>T3 may legitimately end without integration.</strong> Permanent coexistence, or divestment, are valid outcomes. Real mergers most often fail at systems integration; an architecture that assumes eventual convergence is lying about its own limits.</p>
|
|
<h3>Known cost</h3>
|
|
<p><code>prj-state-hub-retirement</code> is a T3 reconciliation inside a <em>single</em> organization — two hub implementations, distinct infrastructure. It required a dedicated project repository, a 425-item disposition inventory (<code>SHR-INV-0001</code>), staged migration with strangler adapters, and explicit retirement gates. That is the realistic cost of T3 under the most favourable conditions possible: one owner, one canon, one credential authority.</p>
|
|
<p>Nothing here reduces that cost. Declared postures make it <strong>visible before</strong> a fork is created rather than discovered when reconciliation is attempted.</p>
|
|
</section>
|
|
<section id="consequences"><h2>Consequences</h2>
|
|
<p><strong>Positive.</strong> Disconnected operation stops requiring a coordinator for identity. <code>ADR-007</code> decision 1's contradiction is resolved rather than tolerated. A namespace mid-journey can describe itself honestly instead of being non-conformant. Reconciliation cost becomes computable in advance. Client instances become expressible.</p>
|
|
<p><strong>Negative.</strong> Every namespace gains a posture to declare and keep accurate, and tooling must learn qualified references. Decision 8's coupling rule constrains disconnected operation to namespaces that can reconcile — deliberately.</p>
|
|
<p><strong>Deferred.</strong> Merge machinery for T2 is <strong>not</strong> specified here and should not be built until a real fork needs it. T3 needs no machinery by definition; it needs a project repository and human judgement.</p>
|
|
<p><strong>Amended.</strong> <code>ADR-007</code> decision 1 — uniqueness is namespace-scoped. <code>ADR-007</code> decision 2 — derivation input becomes <code>(namespace, identifier)</code>.</p>
|
|
</section>
|
|
<section id="open-question"><h2>Open question</h2>
|
|
<p><strong>What is the namespace boundary in practice?</strong> Candidates: a fleet instance (<code>railiance01</code>), a client deployment, or an FOS autonomous domain. FOS's recursion — "from projects to companies to foundation-like umbrella structures" — suggests namespaces <strong>nest</strong>, which would make qualification relative rather than absolute, closer to DNS than to a flat handle. The notation survives either answer, so implementation is not blocked, but the data model is unfinished until it is settled.</p>
|
|
</section>
|
|
<section id="references"><h2>References</h2>
|
|
<ul><li><code>canon/standards/federated-organization-standard_v1.0.md</code> — bounded autonomy, escalation, sovereignty by default, rebuildability</li><li>ADR-001 — workplans originate as repo files</li><li>ADR-007 — identifier uniqueness and derived identifiers (amended here)</li><li>ADR-008 — Multi-Tenancy Framework; source of the plane/ladder/posture form and the accuracy-not-altitude conformance rule</li><li>ADR-010 — hub authority, local cache, and the two kinds of hub data</li><li><code>CUST-WP-0058</code> — instance-per-client tenancy</li><li><code>SHR-INV-0001</code> — 425-item disposition inventory, T3 cost evidence</li><li><code>RMGR-WP-0004-T02</code> — <code>rmgr conform</code>, the guard machinery</li></ul>
|
|
</section><footer><span>CUST-ADR-011 · draft-2 · proposed</span><span>the-custodian · canon/architecture/adr-011-federated-namespaces-and-reconciliation-limits.md · f9435cd605cc5b3cb0f2e957ce6287d9f3129aac</span></footer></main></div></div></html>
|