coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs(canon): renumber ADR-008/009 -> ADR-010/011 after ID collision
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
ADR-008 and ADR-009 were concurrently allocated by two authors on
2026-08-17. adr-008-multi-tenancy-model.md (Four Planes) has earlier
provenance and keeps 008; 009 is left free for that lane. Hub authority
becomes ADR-010, federated namespaces ADR-011. Cross-references in ADR-007
updated.

A live demonstration of ADR-007 decision 1's own subject: sequential
allocation with concurrent writers. ADR numbering is not covered by that
decision, which governs PREFIX-WP-NNNN only — gap to close.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-17 13:04:04 +02:00
parent 04f888399f
commit d710888dc6
3 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md
View file

@ -82,7 +82,7 @@ nothing prevents number reuse.
**1. A workplan identifier is globally unique.** `PREFIX-WP-NNNN` names exactly **1. A workplan identifier is globally unique.** `PREFIX-WP-NNNN` names exactly
one workplan across the entire fleet, for all time. one workplan across the entire fleet, for all time.
> **Amended 2026-08-17 by `ADR-009` decision 2.** Uniqueness and forward-only > **Amended 2026-08-17 by `ADR-011` decision 2.** Uniqueness and forward-only
> allocation are **namespace-scoped**, not global; global identity is the pair > allocation are **namespace-scoped**, not global; global identity is the pair
> `(namespace, identifier)`, written `PREFIX-WP-NNNN@namespace` when foreign. > `(namespace, identifier)`, written `PREFIX-WP-NNNN@namespace` when foreign.
> Global sequential allocation would require a central coordinator — the exact > Global sequential allocation would require a central coordinator — the exact
@ -103,7 +103,7 @@ It also inverts ADR-001 — a file carrying a hub's private key is the file
holding hub state. holding hub state.
*Target state (C2).* `state_hub_workstream_id` and `state_hub_task_id` become *Target state (C2).* `state_hub_workstream_id` and `state_hub_task_id` become
**deterministic**: UUIDv5 derived from the workplan identifier. Per `ADR-009` **deterministic**: UUIDv5 derived from the workplan identifier. Per `ADR-011`
decision 3 the derivation input is the pair `(namespace, identifier)`, not the decision 3 the derivation input is the pair `(namespace, identifier)`, not the
identifier alone — deriving from the identifier alone would make two forks identifier alone — deriving from the identifier alone would make two forks
holding unrelated work under the same number compute the same UUID. Every instance computes the same value independently, writeback holding unrelated work under the same number compute the same UUID. Every instance computes the same value independently, writeback
@ -120,11 +120,11 @@ Decision 1 must therefore be enforced before derivation ships.
identifiers into repository files. Other instances may read, project, and serve, identifiers into repository files. Other instances may read, project, and serve,
but must not mint workplan or task UUIDs into git-tracked files. but must not mint workplan or task UUIDs into git-tracked files.
> **Corrected 2026-08-17, superseded by `ADR-008` decisions 1–3.** This decision > **Corrected 2026-08-17, superseded by `ADR-010` decisions 1–3.** This decision
> originally described workstation hubs as "development read replicas". That was > originally described workstation hubs as "development read replicas". That was
> wrong on both counts: the workstation instance was not a replica, and it was > wrong on both counts: the workstation instance was not a replica, and it was
> the *larger* of the two, holding 306 more workplans than the primary. The two > the *larger* of the two, holding 306 more workplans than the primary. The two
> instances were peer databases. `ADR-008` establishes the central hub as > instances were peer databases. `ADR-010` establishes the central hub as
> authoritative and local instances as rebuildable caches, which is what makes > authoritative and local instances as rebuildable caches, which is what makes
> this interim rule coherent. > this interim rule coherent.

4
canon/architecture/adr-008-hub-authority-and-local-cache-model.md → canon/architecture/adr-010-hub-authority-and-local-cache-model.md
View file

@ -1,5 +1,5 @@
--- ---
id: ADR-008 id: ADR-010
type: architecture-decision-record type: architecture-decision-record
title: "Hub Authority, Local Cache, and the Two Kinds of Hub Data" title: "Hub Authority, Local Cache, and the Two Kinds of Hub Data"
status: proposed status: proposed
@ -8,7 +8,7 @@ date: "2026-08-17"
tags: ["architecture", "state-hub", "repo-manager", "hub-core", "authority", "cache", "offline", "adr-001"] tags: ["architecture", "state-hub", "repo-manager", "hub-core", "authority", "cache", "offline", "adr-001"]
--- ---
# ADR-008: Hub Authority, Local Cache, and the Two Kinds of Hub Data # ADR-010: Hub Authority, Local Cache, and the Two Kinds of Hub Data
## Status ## Status

10
canon/architecture/adr-009-federated-namespaces-and-reconciliation-limits.md → canon/architecture/adr-011-federated-namespaces-and-reconciliation-limits.md
View file

@ -1,5 +1,5 @@
--- ---
id: ADR-009 id: ADR-011
type: architecture-decision-record type: architecture-decision-record
title: "Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation" title: "Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation"
status: proposed status: proposed
@ -8,11 +8,11 @@ date: "2026-08-17"
tags: ["architecture", "federation", "namespace", "identity", "reconciliation", "fos", "adr-007", "adr-008"] tags: ["architecture", "federation", "namespace", "identity", "reconciliation", "fos", "adr-007", "adr-008"]
--- ---
# ADR-009: Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation # ADR-011: Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation
## Status ## Status
Proposed. Amends `ADR-007` decision 1 and extends `ADR-008` decision 4. Proposed. Amends `ADR-007` decision 1 and extends `ADR-010` decision 4.
## Context ## Context
@ -77,7 +77,7 @@ lineage, a shared identifier is ambiguous between *the same work, diverged* and
*different work, colliding* — a distinction that cannot be reconstructed after *different work, colliding* — a distinction that cannot be reconstructed after
the fact. the fact.
**5. Mutable state is derived from an append-only log.** Extending `ADR-008` **5. Mutable state is derived from an append-only log.** Extending `ADR-010`
decision 4: status and other mutable fields are a fold over append-only events decision 4: status and other mutable fields are a fold over append-only events
rather than fields to be reconciled. Reconciliation then becomes union-of-events rather than fields to be reconciled. Reconciliation then becomes union-of-events
plus re-derivation — deterministic, order-independent, and requiring no plus re-derivation — deterministic, order-independent, and requiring no
@ -167,6 +167,6 @@ absolute. Settle before implementation; the notation works either way.
escalation, sovereignty by default, rebuildability escalation, sovereignty by default, rebuildability
- ADR-001 — workplans originate as repo files - ADR-001 — workplans originate as repo files
- ADR-007 — identifier uniqueness and derived identifiers (amended here) - ADR-007 — identifier uniqueness and derived identifiers (amended here)
- ADR-008 — hub authority, local cache, and the two kinds of hub data - ADR-010 — hub authority, local cache, and the two kinds of hub data
- `CUST-WP-0058` — instance-per-client tenancy - `CUST-WP-0058` — instance-per-client tenancy
- `SHR-INV-0001` — 425-item disposition inventory, T3 cost evidence - `SHR-INV-0001` — 425-item disposition inventory, T3 cost evidence