8c2825f4c3
Refines decision 7. Per-repository rebuild is not a convenience over a fleet-wide operation: the repository is the unit, and the fleet-wide form is defined as iteration over it. It follows from the source — each forge repository has its own history and head, so its projection is derivable and provable in isolation. It bounds blast radius, which is what makes "routine" achievable: a rebuild that only runs fleet-wide is one nobody runs casually and therefore nobody runs, which is how ADR-010's never-executed reconstruction claim came to be believed. It is also the only form that composes with the refusals. A repository holding projection-only records can be held back while healthy ones rebuild; an all-or-nothing reset is blocked permanently by a single bad repository. The refusal is therefore evaluated per repository, and a fleet run skips and reports rather than aborting. The fleet-wide form must share the per-repository implementation, so the rare dangerous path is exercised by the common safe one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| architecture | ||
| constitution | ||
| projects | ||
| standards | ||
| tpsc | ||
| values | ||