[polewskm]

Nothing reads a stored shape the serving code doesn't write, and no identifier or version is held for an unreleased state. That follows the project owner's standing direction: nothing is shipped, so there is no earlier data to keep readable.

• A stored record that lacks what the serving code writes is malformed and fails closed (ADR-1395).``
  • A grant payload that isn't a $ver/$payload envelope is rejected with a JsonException. The envelope and upcaster seam stay for use after the first release.
  • A session grant carries required IdleTimeout and AbsoluteExpiresWhen, written with its payload. DefaultSessionService refuses to serve a session grant without an expiration.
  • A tenant without an issuer is malformed and fails closed.
• Identifiers and versions start at their first released value (ADR-1397).```
  • The audit record's schema_version is 1.0, which includes tenant_environment_type. Adding a field bumps the minor version.
  • The log event ID lists hold assigned IDs only, with nothing reserved.

ADR-1395 overrides project-template ADR-0108's rule that a document without $ver is read as version 1; #542 proposes the matching template change. #535 carries the release-time step: from then on, a grant payload evolves through a version bump and an upcaster, and a shipped event ID is never reused.

[ncode-review]

🤖 NCode Review at 38e2b73: 2 new findings on the changed lines.

Not on a changed line:

• 🟡 F2 Nit: Amended ADR bodies still contradict their new status lines docs/decisions/1283-audit-records-are-cloudtrail-shaped-json-with-an-indexable-envelope.md:105. ADR-1283 decision 13 still says 14003 and 14004 are reserved and never reused, while its status line says they are free. ADR-1220 (around line 57) still describes a session stored without an absolute end. Fix: If the convention is to update the body as well as the amendment line, edit ADR-1283 decision 13 and the ADR-1220 text so they match.

[ncode-review]

_{Superseded by the review at 68654f1.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #545      +/-   ##
==========================================
- Coverage   92.18%   85.49%   -6.69%     
==========================================
  Files        1513     1495      -18     
  Lines       63624    61985    -1639     
  Branches      306      707     +401     
==========================================
- Hits        58649    52992    -5657     
- Misses       4975     8993    +4018     

Flag	Coverage Δ
dotnet	84.83% <100.00%> (-7.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[polewskm]

Autopilot: F2 (not on a changed line, no change): ADR-1283 decision 13 and the ADR-1220 text are the bodies of accepted records. The repository updates an accepted record through its status, not its body: docs/decisions/README.md says a new record "supersedes the old one (and update the old one's status) rather than editing history", and ADR-1393 decision 5 makes the Status, Amends and Supersedes lines the mechanism. ADR-1283's and ADR-1220's status lines name ADR-1397 and ADR-1395, and those records state the decisions that hold: the log event IDs list assigned IDs only, and a session grant has required bounds.

---

Generated by Claude Code

[polewskm]

/review

[ncode-review]

🤖 Review complete

Verdict: ✅ Approve — Deep review (sensitive paths): Re-review of what changed since the last review at 38e2b73: 29 hunks in 8 files and changes taken back in 3 files, by correctness and security. No further findings above nits.

2 reviewers run — 0 findings (run details)

Reviewer	Model	Findings	Top
correctness	opus-5-5	0	🟢
security	opus-5-5	0	🟢

_{Trial: findings are posted as review threads and in the check run. $0.31 on Amazon Bedrock, 23s, at 68654f1. (how to interact)}

📋 Outcomes

Merged at a09410a: 2 fixed, 0 dismissed, 0 acknowledged, 0 ignored.

Finding	Reviewer	Severity	Outcome
F1	correctness	🟠 Should fix	✅ fixed
F3	rule-check	🟡 Nit	✅ fixed

[polewskm]

Autopilot: Ready to merge. NCode Review approves 68654f1 with no findings, every review thread has a reply, and CI is green. It touches the same changelog and decision-index area as #544, so if one lands first and the other conflicts, I'll merge main into the second and push the resolution.

---

Generated by Claude Code

[polewskm]

Autopilot: merged main (#531, #543 and #544) and resolved the conflicts.

• Event ID clash with feat: store verify-only client secrets as one-way verifiers #531. feat: store verify-only client secrets as one-way verifiers #531 had already taken Base + 70 for ClientAuthenticationSecretVerificationUnavailable, so EndedSessionTerminationFailedForSession moves to Base + 71 (event 2071). ADR-1395 now names the new number, and the code refers to the constant by name.
• Documentation conflicts with refactor: keep one InitialCreate per database context and remove retired settings #544. The status lines of ADR-1220 and ADR-1223 and the decision index rows for 1218–1223 list both ADR-1395 and ADR-1394. The index lists 1393–1397 in number order.

./build/dod.ps1 -Fast -Affected passed after the #531 merge. The #544 merge conflicted only in documentation, so it was pushed without re-running the gate. This is safe to re-queue once CI is green.

---

Generated by Claude Code