coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

canon(ADR-007): rule derivation scope for C2 -- live records only
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
ADR-011 decision 7 keys derivation on (namespace, identifier), which
separates forks but not collisions inside one namespace. The ecosystem is at
N1, a single implied namespace, and a 2026-08-21 fleet scan finds 20 reused
identifiers across 48 files all inside it. So ADR-011 alone does not satisfy
decision 2's uniqueness prerequisite.

Ruled: C2 derives for live records only; archived records keep frozen minted
identifiers. This reconciles Migration option 2 with the uniqueness
derivation needs, and cuts the remediation surface from 48 files to 11.

Records the two consequences that follow -- un-archiving is a collision
hazard, and derivation is not retroactive -- and why treating a repository as
the namespace was rejected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-21 06:36:06 +02:00
parent c72fd7cfa4
commit 0b0254a85d
1 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md
View file

@ -152,6 +152,34 @@ being retired under `STATE-WP-0079`.
Migration scope for C2: **758 workplan files** across the fleet currently carry
these fields.
> **Amended 2026-08-21 — derivation scope for C2.** `ADR-011` decision 7 keys
> derivation on `(namespace, identifier)`, which separates *forks*. It does not
> separate collisions inside one namespace, and the ecosystem's posture is `N1`
> — a single implied namespace. A fleet scan on 2026-08-21 found **20 reused
> identifiers across 48 files**, all within that one namespace, so the
> prerequisite above is not satisfied by `ADR-011` alone.
>
> Ruled: **C2 derives only for live records; archived records keep their minted
> identifiers, frozen.** This is what reconciles § Migration option 2 — under
> which historical files keep colliding identifiers — with the uniqueness
> derivation requires. Of the 20, only **five** collide among live files, so the
> remediation surface is 11 files rather than 48.
>
> Two consequences follow, and both are load-bearing:
>
> 1. **Un-archiving a record with a frozen identifier is a collision hazard.**
> A record returning to live status must be checked against the live
> namespace before it is re-derived, and renumbered if it clashes.
> 2. **Derivation is not retroactive.** Existing live records keep their minted
> UUIDs until they are re-derived deliberately; C2 changes provenance for new
> and re-registered records, not the whole corpus at once.
>
> Rejected: treating a *repository* as the namespace. That would make the
> collisions vanish by construction, but it redefines the term `ADR-011`
> decision 1 fixes as "a fleet instance, a client deployment, an autonomous
> domain", and `ADR-011` decision 9 warns specifically against reading N-plane
> movement into claims it does not support.
**3. Lifecycle status is not automatically promoted.** An automated
normalization pass may report drift; it may not move a workplan from `proposed`
to `active`. `proposed` means awaiting human review, and an automation that