Skip to content

Commit f9a9e76

Browse files
os-justinclaude
os-justin
and
claude
authored
docs(adr): ADR-0132 / ADR-0133 Status moves to Accepted — each record carries its own landing PR and commit (#18711)
Fixes #18532 Clause-②: no ## The defect ADR-0132 and ADR-0133 both landed on `main` on 2026-09-07, and both still carried a `**Status**` line reading `Proposed (2026-09-06) — awaiting the maintainer's hand-merge, which is (itself) the acceptance act for a governed surface (Prime Directive #14)`. Read by the record's own rule, the acceptance act it names had occurred; only the line was never updated — and the Status field is the one machine-readable statement of a governance record's force, so anyone judging "can I cite this as settled law?" from it got the wrong answer while the body below it told them nothing here is settled. The failure direction is silent: both files are on `main`, every gate is green, and nothing reds. The positive controls are in the same convention and one number apart — ADR-0130 and ADR-0131 each moved their line to `Accepted` on landing and pointed back at the PR and commit that landed them. This PR does the same for 0132 and 0133, with each record's own landing facts, and changes nothing else. ## The four Status lines, before and after Measured on this branch's base, `origin/main` at `f8eaf6704` (the card's own readings were taken earlier, on `1e496f979`). The two controls are quoted to show the target form; ⛔ neither is touched by this PR. **ADR-0130 :3 — positive control, unchanged** ```text **Status**: Accepted (2026-09-01) — accepted by the merge that landed it on `main` ([#14151](#14151), commit `682d03ba7`), which is itself the acceptance act for a governed surface (Prime Directive #14). ``` **ADR-0131 :3 — positive control, unchanged** ```text **Status**: Accepted (2026-09-04) — accepted by the merge that landed it on `main` ([#14976](#14976), commit `0ed271574`), which is itself the acceptance act for a governed surface (Prime Directive #14). Execution is paused under #15193 and the maintainer's standing instruction; that pause is carried there, not by this status line. ``` **ADR-0132 :3 — BEFORE (three physical lines, wrapped under a list dash)** ```text - **Status**: Proposed (2026-09-06) — awaiting the maintainer's hand-merge, which is itself the acceptance act for a governed surface (Prime Directive #14). ⛔ Nothing below is settled until this record merges. ``` **ADR-0132 :3 — AFTER** ```text - **Status**: Accepted (2026-09-07) — accepted by the merge that landed it on `main` ([#16215](#16215), commit `c677cda816`), which is itself the acceptance act for a governed surface (Prime Directive #14). ``` **ADR-0133 :3 — BEFORE (one unwrapped physical line)** ```text - **Status**: Proposed (2026-09-06) — awaiting the maintainer's hand-merge, which is the acceptance act for a governed surface (Prime Directive #14). ⛔ Nothing in this file is a new decision; see [Provenance](#provenance--read-this-before-citing-this-file). ``` **ADR-0133 :3 — AFTER** ```text - **Status**: Accepted (2026-09-07) — accepted by the merge that landed it on `main` ([#16267](#16267), commit `13c08356ab`), which is the acceptance act for a governed surface (Prime Directive #14). ⛔ Nothing in this file is a new decision; see [Provenance](#provenance--read-this-before-citing-this-file). ``` Three shape decisions, each read off the controls rather than invented: 1. **Each file keeps its own local form.** 0132 :3 is a wrapped list item under a dash and stays one (three physical lines, wrapped at the same column its sibling bullets use); 0133 :3 is a single unwrapped list line and stays one. ⛔ Neither file is reformatted toward the other, and ⛔ neither is reformatted toward 0130 / 0131, which carry no list dash at all. 2. **0132 keeps `which is itself the acceptance act`; 0133 keeps `which is the acceptance act`.** That word differs between the two files today, and the controls do not settle it — 0130 and 0131 both say `itself`. Each file keeps the wording it already had. 3. **The trailing sentence is treated the way the controls treated theirs.** Neither 0130 :3 nor 0131 :3 carries a "nothing is settled until this merges" clause, so 0132's is dropped rather than turned past tense. 0133's trailing ⛔ sentence is a *different* sentence — it says this file records no new decision and points at Provenance, which is as true after the merge as before — so it is preserved byte-for-byte. ## Landing facts, and how each was verified | record | landing PR | squash commit | merged | merged by | |:--|:--|:--|:--|:--| | ADR-0132 | [#16215](#16215) | `c677cda816f70c3e46fa1e3ad451a6d43f50dd07` | 2026-09-07T06:15:26Z (commit date 2026-09-07T05:30:13Z) | os-zhuang | | ADR-0133 | [#16267](#16267) | `13c08356abc61f13acd5db0932f99d482c134588` | 2026-09-07T07:37:31Z (commit date 2026-09-07T07:19:25Z) | os-zhuang | Verification, per record, all four legs: - **Single-parent squash.** `git log -1 --format='%P'` returns exactly one parent for each (`acabd24879…` for 0132, `8976ea1120…` for 0133). - **The subject names the PR.** `…(ADR-0132) (#16215)` and `…mirroring cloud ADR-0081 D1/D3/D4 with Provenance (#16267)`. - **The commit introduced the file.** `git show --stat SHA -- docs/adr/0132-…md` → `1 file changed, 225 insertions(+)`; the same for 0133 → `273 insertions(+)`. Both are file creations, so each sha is the landing of its own record and not a later edit. - **The sha is an ancestor of `main`** — `git merge-base --is-ancestor SHA origin/main`, exit 0 for both. ⚠️ **That ancestry reading needed a control leg, and the first reading was wrong.** This container's checkout is shallow. On the shallow window as fetched (boundary `5de93728a`, 2026-09-09T21:18Z) `--is-ancestor` answered **exit 1 — "not an ancestor"** for both shas, which are dated 2026-09-07 and therefore *outside* the window: a confident false negative, because the missing objects withhold the ancestry path without fabricating one. After `git fetch --shallow-since=2026-08-25 origin main` (694 → 2867 commits) both test legs answer exit 0, and two control commits at least as deep as the tested pair — `682d03ba7` (ADR-0130's own landing, 2026-09-01) and `0ed271574` (ADR-0131's, 2026-09-04) — also answer exit 0, so the negative is retired rather than merely re-rolled. All four exit codes are recorded. The `merged_at` / `merged_by` values come from one REST read each of `/repos/objectstack-ai/objectstack/pulls/16215` and `/pulls/16267`; both report `merged: true`, `base.ref: main`, and a `merge_commit_sha` byte-equal to the sha in the table. This also answers the card's explicitly unmeasured worry about ADR-0133 — whether its landing constituted the hand-merge its own line named. It did: `merged_by` is os-zhuang, the authorized approver. So both records are "the text went stale", ⛔ not "an unaccepted governance record is being cited as law", and one line each is the whole repair. **The date in `Accepted (…)` is the landing date**, as 0130 and 0131 do — 2026-09-07 for both, which is the date on both the squash commit and the merge event. ## Consumers — a reading, no edit `git grep -n 'ADR-0132\|ADR-0133\|0132-multi-organization\|0133-org-management'` at `a937609f6c`: **110 hits across 51 files**. ⛔ None is edited by this PR. By area: | area | files | |:--|--:| | `packages/plugins/**` (organizations, plugin-auth, plugin-dev, plugin-security) | 18 | | `packages/qa/dogfood/**` | 7 | | `packages/cli/**` | 5 | | `packages/verify/**` | 4 | | `packages/spec/**` | 3 | | `docs/adr/**` (0105, 0132, 0133 themselves) | 3 | | `skills/objectstack-data/**` | 2 | | `packages/services/service-cluster/**` | 2 | | `.changeset/**` | 3 | | `content/docs`, `docs/qa`, `packages/types`, `scripts/` | 4 | The card names the census on [#17379](#17379) as one reader built on ADR-0132; the grep shows the reliance is much wider than one card — `packages/plugins/organizations` alone cites it in its plugin, its README and nine tests, including pin tests that name the record as the authority for the wall they hold. ## Verification Derived — ⛔ no hand-fed path list — with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` from the worktree; the tool took the change set itself (three-dot vs the merge base) and printed the two ADR paths. **18 families derived, 18 run, all exit 0**, at head `a937609f6c`: ```text node scripts/check-adr-links.mjs :: exit 0 node scripts/check-adr-links.mjs --self-test :: exit 0 node scripts/check-adr-symbol-anchors.mjs :: exit 0 node scripts/check-adr-symbol-anchors.mjs --self-test :: exit 0 node scripts/check-ci-filter-parity.mjs :: exit 0 node scripts/check-closing-keyword-parity.mjs :: exit 0 node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0 node scripts/check-comment-mask-corpus.mjs :: exit 0 pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0 pnpm check:adr-anchors :: exit 0 pnpm check:cross-package-test-inputs :: exit 0 pnpm check:doc-authoring :: exit 0 pnpm check:driver-memory-census :: exit 0 pnpm check:nul-bytes :: exit 0 pnpm check:pm-governed-merges :: exit 0 pnpm check:pm-prior-rulings :: exit 0 pnpm check:refd-timer-probe :: exit 0 pnpm check:watch-hint-literal :: exit 0 ``` Reconciled: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran RANFILE` → exit 0, `18 derived famil(ies) accounted for — 18 run, 0 NOT-MEASURED (a DERIVED zero — all 18 recorded an exit code and none of them is 3)`. Beyond the derived set: ```text node scripts/pm/check-governed-merges.mjs --test docs/adr/0132-….md docs/adr/0133-….md :: exit 3 pnpm lint (repo-wide, `eslint . --no-inline-config`, ⛔ not narrowed) :: exit 0 ``` **Exit 3 on the governed predicate is the verdict, ⛔ not a failure**: `GOVERNED — a human merge is the review record for this PR (#9495 regime)`, `docs/adr/** ×2`. This PR is draft and stays draft; ⛔ no seat flips it ready, enqueues it or arms auto-merge. Exit codes were captured with redirect-then-`$?`, ⛔ never across a pipe. ⚠️ **One gate refused before it measured anything, and was re-run rather than recorded as a pass.** On the first sweep `pnpm --filter @objectstack/lint run check:doc-formula-expressions` exited **3** — `PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built`, the script's own wording being `Nothing was measured: this gate exited before running a single check`. That is NOT MEASURED, neither green nor red. After `pnpm exec turbo run build --filter=@objectstack/formula --filter=@objectstack/lint` (through `scripts/pm/os-verify-lock.sh`, `VERDICT command-exit 0`) it exits 0. Only the exit-0 run is reported above. ⚠️ **What this list does not cover** — the derivation says so itself, and it is repeated here so the green is not read wider than it is: 53 artifact-roster families (their `silent` verdict is a fact about a tracked list, ⛔ not a clearance), 11 families whose declared population is too wide to place, 2 families whose argv takes a value only CI supplies, 1 CI job scheduled by these paths whose 5 steps have no local invocation, and 14 families that apply only once a changeset exists — ⛔ not applicable here, see below. Those are CI's to answer on this PR. **Tree state.** `origin/main` moved three commits (`72dd95fa5a`) while this ran, and the derivation flagged the tree stale for one file it reads (`scripts/pm/post-stamped.mjs`). `origin/main` was merged in (5 files, all disjoint from this diff, no `os-regen` deferral), `@objectstack/formula` and `@objectstack/lint` were force-rebuilt because the merge moved `packages/formula/src/validate.ts`, and the whole sweep above was re-derived and re-run at the merged head `a937609f6c`. The re-derivation produced a byte-identical 18-command list and no staleness warning. Every number quoted here is from that head. ## Changeset `skip-changeset`. `docs/adr/**` is on the no-publish fast track: no package's `files[]` ships an ADR, and the diff is four lines of prose in two governance records. `Clause-②: no` — ⛔ nothing an author can write moves. ## Diff ```text docs/adr/0132-multi-organization-runtime-is-open-core.md | 6 +++--- docs/adr/0133-org-management-open-basics.md | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) ``` Two files, one logical Status line each. 0132 counts as three physical lines because its line is a wrapped bullet, before and after. ## Acceptance notes ⛔ None of the following is filed as a card; each is recorded here for the reviewing seat. 1. **ADR-0133 :85–:97 carries a pre-merge frame that survived its own merge, and is deliberately ⛔ not touched.** The block is headed `⚠️ **A note for the hand-merge, stated rather than decided.**` and ends `**If the maintainer prefers one combined record, that is still a merge-time call** — the two files are disjoint, so folding them is a move, not a rewrite.` It addresses a reader who has not merged the file yet. Quoted here because the dispatch required any such sentence be quoted before touching it: ⛔ it is not touched, because it asserts nothing about this record's acceptance state — it offers a structural option about folding 0133 into 0132 — and scope excludes every other line in both files. The same block already reads `That obstacle is gone — the record has landed`, about ADR-0132. 2. **Two premises in the dispatch text did not survive measurement on this tree; neither changed the deliverable.** (a) The dispatch said the `acceptance act` phrase occurs in the *bodies* of 0132 (twice) and 0133 (once), to be left untouched. Measured: `grep -c` gives **1** in each file, and in both cases that single occurrence **is** the Status line this PR edits — there is no body occurrence in either file to leave alone. The 2× / 1× counts belong to 0130 / 0131, which is what the card itself says. (b) The dispatch described 0133's Status line as carrying the `Nothing … is settled until this record merges` sentence. It does not; its trailing ⛔ sentence is the unrelated `Nothing in this file is a new decision` one, which is preserved. The card's own table quoted 0133 correctly. 3. **Short-sha spelling.** 0130 and 0131 use 9 hex digits, which is what `git rev-parse --short` emitted at their time. On this tree, after deepening, the default abbreviation is 10 — and 10 is also the spelling the card body and the claim comment both recorded (`c677cda816`, `13c08356ab`). This PR uses 10 so that the file, the card and the claim agree; the full 40-hex shas are in the landing table above. The sentence *form* is the controls' form exactly. 4. **⛔ ADR-0134 and the other 17 `Proposed` records are untouched**, per the card. 0134's `Proposed` mirrors cloud ADR-0071's own state and is self-explanatory; the other 17 were never measured by the card and a batch edit would treat an unmeasured population as a measured one. ## 维护者速读(草稿) **改了什么** —— 两份治理记录(ADR-0132、ADR-0133)的 `**Status**` 行,各改一行:从「Proposed —— 等待维护者手工合并,而那次合并本身就是接受行为」改成「Accepted (2026-09-07) —— 由把它落到 `main` 上的那次合并接受」,并各自回指自己的落地 PR 与提交(0132 → #16215 / `c677cda816`;0133 → #16267 / `13c08356ab`)。两份文件的其余内容、另外 17 份 `Proposed` 的 ADR、以及看着同形但必须排除的 0134,全部未动。整个 diff 是 2 个文件、4 行增、4 行删。 **为什么改** —— 这两份 ADR 早在 2026-09-07 就已经合并进 `main`,而且都是由授权批准人 os-zhuang 合的 —— 也就是说,它们自己那行字所说的「接受行为」**确实已经发生了**,只是没有人回去改那一行。ADR 的 Status 字段是这份记录唯一一处机器可读的效力声明:今天任何人(或任何工具)按它判断「这条能不能当既定法引用」,得到的都是错的答案,而正文还在要求读者「在这份记录合并之前,下面的一切都未定」。实测有 **51 个文件、110 处**引用这两份 ADR,其中 `packages/plugins/organizations` 的插件、README 和九个测试都把它当权威引用。⚠️ 这个失效是**沉默的**:两份都在 `main` 上,CI 全绿,没有任何门禁会因此变红 —— 所以它只能靠人读出来。同一套约定的 ADR-0130 / 0131 落地后都改成了 `Accepted` 并回指落地 PR,本 PR 照抄它们的拼法,⛔ 没有发明第三种。 **风险与代价(含回滚)** —— 风险极低:改的是四行散文,不改任何决策文本、任何标题、任何代码,不发布任何 npm 包内容(故 `skip-changeset`)。本地推导出的 18 个门禁族全部 exit 0,仓库级 `pnpm lint` 也 exit 0。⚠️ 唯一需要您知道的判断:**这两份记录被判定为「文字过时」,而不是「未被接受却已被当法引用」** —— 依据是两份的合并人都是 os-zhuang(授权批准人),卡片里原本存疑的正是 ADR-0133 这一条,现已查实。若您认为 ADR-0133 那次合并**不**构成它所说的接受行为,那么正确的修法与本 PR **相反**(要补一次接受行为,而不是改一行字),此时请直接关掉本 PR —— 回滚成本就是关掉它,没有任何其他产物需要撤。 **席位意见** —— **你要做的** —— ① 确认上面那条判断:ADR-0133 由 os-zhuang 合并,是否算作它那行字所说的「维护者手工合并 = 接受行为」。② 若认可,本 PR 是受管面(`docs/adr/**`),按 Prime Directive #14 需要您本人的手工合并或一次授权批准 —— ⛔ 本 PR 恒为 draft,任何 AI 席位都不会把它翻成 ready、不会入队、不会开 auto-merge。③ 若您希望连带把另外 17 份 `Proposed` 的 ADR 一起盘一遍,那是另一张卡 —— 本卡刻意没量它们。 --- _Generated by [Claude Code](https://claude.ai/code/session_01Gqi43smmqjJ5sUrhfoPeKu)_ Co-authored-by: Claude <noreply@anthropic.com>
1 parent 802a91b commit f9a9e76

2 files changed

Lines changed: 4 additions & 4 deletions

File tree

‎docs/adr/0132-multi-organization-runtime-is-open-core.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# ADR-0132: The multi-organization runtime is open core — single-database organization isolation ships open; only the entitlement stays commercial
22

3-
- **Status**: Proposed (2026-09-06) — awaiting the maintainer's hand-merge, which is itself the
4-
acceptance act for a governed surface (Prime Directive #14). ⛔ Nothing below is settled until
5-
this record merges.
3+
- **Status**: Accepted (2026-09-07) — accepted by the merge that landed it on `main`
4+
([#16215](https://github.com/objectstack-ai/objectstack/pull/16215), commit `c677cda816`), which
5+
is itself the acceptance act for a governed surface (Prime Directive #14).
66
- **Deciders**: ObjectStack maintainer, 2026-09-06, live chat, verbatim and untranslated: the
77
question that opened it 「感觉 单库多组织隔离是开源基本需求，如果迁移回开源项目成本有多大」, the
88
instruction that chartered the work 「直接立专题卡派发处理吧」, and the statement of the effect

‎docs/adr/0133-org-management-open-basics.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# ADR-0133: Organization management — the open basics; a mirror of cloud ADR-0081 D1/D3/D4 in the repository whose code enforces them
22

3-
- **Status**: Proposed (2026-09-06) — awaiting the maintainer's hand-merge, which is the acceptance act for a governed surface (Prime Directive #14). ⛔ Nothing in this file is a new decision; see [Provenance](#provenance--read-this-before-citing-this-file).
3+
- **Status**: Accepted (2026-09-07) — accepted by the merge that landed it on `main` ([#16267](https://github.com/objectstack-ai/objectstack/pull/16267), commit `13c08356ab`), which is the acceptance act for a governed surface (Prime Directive #14). ⛔ Nothing in this file is a new decision; see [Provenance](#provenance--read-this-before-citing-this-file).
44
- **Mirrors**: `objectstack-ai/cloud` **ADR-0081** (Status: Accepted, founder-decided in session, 2026-07-09) — **D1, D3 and D4 only**, the half whose mechanism is open code in this repository.
55
- **Deliberately not mirrored**: cloud ADR-0081 **D2**, its non-goals, and its commercial consequences — cited as `cloud ADR-0081`, never restated here. ⚠️ D2 is absent for a stronger reason than the other two: it has been **reversed** by [ADR-0132](./0132-multi-organization-runtime-is-open-core.md), and the multi-organization machinery it packaged now ships in this repository (`packages/plugins/organizations`). What stays in cloud is that *record* — together with the non-goals and the commercial consequences, which the reversal leaves untouched. See [Relationship to the D2 reversal](#relationship-to-the-d2-reversal-adr-0132).
66
- **Cross-checked against** (cite, do not duplicate): [ADR-0093](./0093-tenancy-mode-and-membership-lifecycle.md) (tenancy mode; the membership lifecycle; D9 already anchors the active-organization resolution), [ADR-0105](./0105-group-tenancy-posture-and-first-class-org-scope.md) (group tenancy posture; D12 anchors the multi-org entitlement), [ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) (total organization ownership; D1/D7/D9)

0 commit comments

Comments
 (0)