From 0b0254a85d253ebac809b1fd1d285b677b4af117 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 21 Aug 2026 06:36:06 +0200 Subject: [PATCH] canon(ADR-007): rule derivation scope for C2 -- live records only ADR-011 decision 7 keys derivation on (namespace, identifier), which separates forks but not collisions inside one namespace. The ecosystem is at N1, a single implied namespace, and a 2026-08-21 fleet scan finds 20 reused identifiers across 48 files all inside it. So ADR-011 alone does not satisfy decision 2's uniqueness prerequisite. Ruled: C2 derives for live records only; archived records keep frozen minted identifiers. This reconciles Migration option 2 with the uniqueness derivation needs, and cuts the remediation surface from 48 files to 11. Records the two consequences that follow -- un-archiving is a collision hazard, and derivation is not retroactive -- and why treating a repository as the namespace was rejected. Co-Authored-By: Claude Opus 5 --- ...kplan-identity-and-repo-worker-topology.md | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md b/canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md index c5b8796..bab998c 100644 --- a/canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md +++ b/canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md @@ -152,6 +152,34 @@ being retired under `STATE-WP-0079`. Migration scope for C2: **758 workplan files** across the fleet currently carry these fields. +> **Amended 2026-08-21 — derivation scope for C2.** `ADR-011` decision 7 keys +> derivation on `(namespace, identifier)`, which separates *forks*. It does not +> separate collisions inside one namespace, and the ecosystem's posture is `N1` +> — a single implied namespace. A fleet scan on 2026-08-21 found **20 reused +> identifiers across 48 files**, all within that one namespace, so the +> prerequisite above is not satisfied by `ADR-011` alone. +> +> Ruled: **C2 derives only for live records; archived records keep their minted +> identifiers, frozen.** This is what reconciles § Migration option 2 — under +> which historical files keep colliding identifiers — with the uniqueness +> derivation requires. Of the 20, only **five** collide among live files, so the +> remediation surface is 11 files rather than 48. +> +> Two consequences follow, and both are load-bearing: +> +> 1. **Un-archiving a record with a frozen identifier is a collision hazard.** +> A record returning to live status must be checked against the live +> namespace before it is re-derived, and renumbered if it clashes. +> 2. **Derivation is not retroactive.** Existing live records keep their minted +> UUIDs until they are re-derived deliberately; C2 changes provenance for new +> and re-registered records, not the whole corpus at once. +> +> Rejected: treating a *repository* as the namespace. That would make the +> collisions vanish by construction, but it redefines the term `ADR-011` +> decision 1 fixes as "a fleet instance, a client deployment, an autonomous +> domain", and `ADR-011` decision 9 warns specifically against reading N-plane +> movement into claims it does not support. + **3. Lifecycle status is not automatically promoted.** An automated normalization pass may report drift; it may not move a workplan from `proposed` to `active`. `proposed` means awaiting human review, and an automation that