fix(identity): enforce qualified ad-hoc identifiers

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118
This commit is contained in:
tegwick 2026-08-23 14:45:26 +02:00
parent 2f74cbd3dd
commit 885575802c
4 changed files with 25 additions and 6 deletions

View file

@ -22,8 +22,11 @@ name bytes: UTF-8(<fleet-namespace> + "\n" + <canonical-identifier>)
The fixed UUID is itself UUIDv5(URL,
`https://helixforge.org/repo-manager/work-record/v1`), but consumers use the
fixed value above rather than recomputing it. Fleet namespace names are
lowercase DNS-label style. Canonical identifiers are
`PREFIX-WP-NNNN` or `PREFIX-WP-NNNN-TNN`.
lowercase DNS-label style. Canonical identifiers are `PREFIX-WP-NNNN`,
`PREFIX-WP-NNNN-TNN`, or the repository-qualified daily forms
`PREFIX-WP-ADHOC-YYYY-MM-DD[-TNN]`. Historic unqualified `ADHOC-*` records are
grandfathered and keep their minted identifiers; new records never use that
collision-prone form.
The repository is not a namespace. The fleet owner declared the current shared
namespace as **`helixforge`** on 2026-08-21; the versioned declaration is