diff --git a/canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md b/canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md index 55f8cbc..a80efb2 100644 --- a/canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md +++ b/canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md @@ -82,7 +82,7 @@ nothing prevents number reuse. **1. A workplan identifier is globally unique.** `PREFIX-WP-NNNN` names exactly one workplan across the entire fleet, for all time. -> **Amended 2026-08-17 by `ADR-009` decision 2.** Uniqueness and forward-only +> **Amended 2026-08-17 by `ADR-011` decision 2.** Uniqueness and forward-only > allocation are **namespace-scoped**, not global; global identity is the pair > `(namespace, identifier)`, written `PREFIX-WP-NNNN@namespace` when foreign. > Global sequential allocation would require a central coordinator — the exact @@ -103,7 +103,7 @@ It also inverts ADR-001 — a file carrying a hub's private key is the file holding hub state. *Target state (C2).* `state_hub_workstream_id` and `state_hub_task_id` become -**deterministic**: UUIDv5 derived from the workplan identifier. Per `ADR-009` +**deterministic**: UUIDv5 derived from the workplan identifier. Per `ADR-011` decision 3 the derivation input is the pair `(namespace, identifier)`, not the identifier alone — deriving from the identifier alone would make two forks holding unrelated work under the same number compute the same UUID. Every instance computes the same value independently, writeback @@ -120,11 +120,11 @@ Decision 1 must therefore be enforced before derivation ships. identifiers into repository files. Other instances may read, project, and serve, but must not mint workplan or task UUIDs into git-tracked files. -> **Corrected 2026-08-17, superseded by `ADR-008` decisions 1–3.** This decision +> **Corrected 2026-08-17, superseded by `ADR-010` decisions 1–3.** This decision > originally described workstation hubs as "development read replicas". That was > wrong on both counts: the workstation instance was not a replica, and it was > the *larger* of the two, holding 306 more workplans than the primary. The two -> instances were peer databases. `ADR-008` establishes the central hub as +> instances were peer databases. `ADR-010` establishes the central hub as > authoritative and local instances as rebuildable caches, which is what makes > this interim rule coherent. diff --git a/canon/architecture/adr-008-hub-authority-and-local-cache-model.md b/canon/architecture/adr-010-hub-authority-and-local-cache-model.md similarity index 99% rename from canon/architecture/adr-008-hub-authority-and-local-cache-model.md rename to canon/architecture/adr-010-hub-authority-and-local-cache-model.md index 69801e0..a5ac00e 100644 --- a/canon/architecture/adr-008-hub-authority-and-local-cache-model.md +++ b/canon/architecture/adr-010-hub-authority-and-local-cache-model.md @@ -1,5 +1,5 @@ --- -id: ADR-008 +id: ADR-010 type: architecture-decision-record title: "Hub Authority, Local Cache, and the Two Kinds of Hub Data" status: proposed @@ -8,7 +8,7 @@ date: "2026-08-17" tags: ["architecture", "state-hub", "repo-manager", "hub-core", "authority", "cache", "offline", "adr-001"] --- -# ADR-008: Hub Authority, Local Cache, and the Two Kinds of Hub Data +# ADR-010: Hub Authority, Local Cache, and the Two Kinds of Hub Data ## Status diff --git a/canon/architecture/adr-009-federated-namespaces-and-reconciliation-limits.md b/canon/architecture/adr-011-federated-namespaces-and-reconciliation-limits.md similarity index 97% rename from canon/architecture/adr-009-federated-namespaces-and-reconciliation-limits.md rename to canon/architecture/adr-011-federated-namespaces-and-reconciliation-limits.md index ac4fe36..907f8aa 100644 --- a/canon/architecture/adr-009-federated-namespaces-and-reconciliation-limits.md +++ b/canon/architecture/adr-011-federated-namespaces-and-reconciliation-limits.md @@ -1,5 +1,5 @@ --- -id: ADR-009 +id: ADR-011 type: architecture-decision-record title: "Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation" status: proposed @@ -8,11 +8,11 @@ date: "2026-08-17" tags: ["architecture", "federation", "namespace", "identity", "reconciliation", "fos", "adr-007", "adr-008"] --- -# ADR-009: Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation +# ADR-011: Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation ## Status -Proposed. Amends `ADR-007` decision 1 and extends `ADR-008` decision 4. +Proposed. Amends `ADR-007` decision 1 and extends `ADR-010` decision 4. ## Context @@ -77,7 +77,7 @@ lineage, a shared identifier is ambiguous between *the same work, diverged* and *different work, colliding* — a distinction that cannot be reconstructed after the fact. -**5. Mutable state is derived from an append-only log.** Extending `ADR-008` +**5. Mutable state is derived from an append-only log.** Extending `ADR-010` decision 4: status and other mutable fields are a fold over append-only events rather than fields to be reconciled. Reconciliation then becomes union-of-events plus re-derivation — deterministic, order-independent, and requiring no @@ -167,6 +167,6 @@ absolute. Settle before implementation; the notation works either way. escalation, sovereignty by default, rebuildability - ADR-001 — workplans originate as repo files - ADR-007 — identifier uniqueness and derived identifiers (amended here) -- ADR-008 — hub authority, local cache, and the two kinds of hub data +- ADR-010 — hub authority, local cache, and the two kinds of hub data - `CUST-WP-0058` — instance-per-client tenancy - `SHR-INV-0001` — 425-item disposition inventory, T3 cost evidence