docs(adr): ADR-0131 — organization ownership is total: no NULL organization_id; declared metadata stays in code; rows only when an organization authored them (Refs #13564) - #14976

Draft

hotlong wants to merge 25 commits into

mainfrom

claude/discussion-13564-a38847

Commits on Sep 3, 2026

docs(adr): ADR-0131 — organization ownership is total: no NULL organization_id, a platform organization owns deployment-level rows, sharing is declared

hotlong
and
claude
committed
601aba5
docs(adr): ADR-0131 D12 — the group posture: group-shared rows have an owner, org-axis red lines stand

hotlong
and
claude
committed
ff2d6e5
docs(adr): ADR-0131 D12 records the withdrawal of ADR-0105 D10 (group template rows / layered master data)

hotlong
and
claude
committed
e2fd907
docs(adr): ADR-0131 v2 — declared metadata stays in code, rows only when an organization authored them, no platform organization

hotlong
and
claude
committed
47db4f6
docs(adr): ADR-0131 D6 — map ADR-0126's three customization regimes onto the two provenances; activation ledger has no reserved column

hotlong
and
claude
committed
6f767f6
docs(adr): ADR-0131 D6 — managed packages are sealed, template packages are copied in and editable, refused on shared-DB multi-tenant; ADR-0005 overlay axis and ADR-0126 O/C regimes paused

hotlong
and
claude
committed
47db4e9
docs(adr): ADR-0131 D6 — the unreleased ADR-0126 flow disable/clone machinery is removed before the next release, not sealed

hotlong
and
claude
committed
11c2dfa
docs(adr): ADR-0131 D3 — the catalog has one home (the environment registry); assignments are organization rows; the four catalog objects retire

hotlong
and
claude
committed
2746f34
docs(adr): ADR-0131 D4 — resolution reads the registry only; no second source, no cross-source uniqueness

hotlong
and
claude
committed
de84c70
docs(adr): ADR-0126 superseded by ADR-0131; staging = one pre-17.3 revert, everything else on the v18 line

hotlong
and
claude
committed
5d55c80
docs(adr): ADR-0131 D7 — the no-column list is decided by the writer, not the name; sys_http_delivery and sys_email are tenant data (#13565, #11741); sys_metadata_activation is reverted before 17.3

hotlong
and
claude
committed
c40b6e3
docs(adr): ADR-0131 D3 — application seed datasets need the Default Organization first; the seed loader's sys_ exemption is withdrawn (#14547 root)

hotlong
and
claude
committed
24821ea
docs(adr): ADR-0131 — record the 2026-09-04 acceptances (install-mode declaration, settings, grant row, overlay axis) and the post-17.2 audit verdicts; one open question remains

hotlong
and
claude
committed
0be9039

Navigation Menu

Uh oh!

docs(adr): ADR-0131 — organization ownership is total: no NULL organization_id; declared metadata stays in code; rows only when an organization authored them (Refs #13564) - #14976

docs(adr): ADR-0131 — organization ownership is total: no NULL organization_id; declared metadata stays in code; rows only when an organization authored them (Refs #13564)#14976
hotlong wants to merge 25 commits into
mainfrom
claude/discussion-13564-a38847

Commits on Sep 3, 2026

docs(adr): ADR-0131 — organization ownership is total: no NULL organization_id, a platform organization owns deployment-level rows, sharing is declared

docs(adr): ADR-0131 D12 — the group posture: group-shared rows have an owner, org-axis red lines stand

docs(adr): ADR-0131 D12 records the withdrawal of ADR-0105 D10 (group template rows / layered master data)

docs(adr): ADR-0131 v2 — declared metadata stays in code, rows only when an organization authored them, no platform organization

docs(adr): ADR-0131 D6 — map ADR-0126's three customization regimes onto the two provenances; activation ledger has no reserved column

docs(adr): ADR-0131 D6 — managed packages are sealed, template packages are copied in and editable, refused on shared-DB multi-tenant; ADR-0005 overlay axis and ADR-0126 O/C regimes paused

docs(adr): ADR-0131 D6 — the unreleased ADR-0126 flow disable/clone machinery is removed before the next release, not sealed

docs(adr): ADR-0131 D3 — the catalog has one home (the environment registry); assignments are organization rows; the four catalog objects retire

docs(adr): ADR-0131 D4 — resolution reads the registry only; no second source, no cross-source uniqueness

docs(adr): ADR-0126 superseded by ADR-0131; staging = one pre-17.3 revert, everything else on the v18 line

docs(adr): ADR-0131 D7 — the no-column list is decided by the writer, not the name; sys_http_delivery and sys_email are tenant data (#13565, #11741); sys_metadata_activation is reverted before 17.3

docs(adr): ADR-0131 D3 — application seed datasets need the Default Organization first; the seed loader's sys_ exemption is withdrawn (#14547 root)

docs(adr): ADR-0131 — record the 2026-09-04 acceptances (install-mode declaration, settings, grant row, overlay axis) and the post-17.2 audit verdicts; one open question remains

Commits on Sep 4, 2026

docs(adr): ADR-0131 D12 — the group posture rule by rule: what ADR-0105 keeps, what this record decides, the costs

docs(adr): ADR-0131 D13 — sys_view_definition retired as inert (verified: no writer/reader in framework, never referenced by objectui); ADR-0017 §3.4/§3.6 amended

docs(adr): ADR-0131 D3 — the position→permission-set binding has no declared vocabulary today; add PositionSchema.permissionSets, migrate junction rows into definitions, §6 Q2 records the alternati…

docs(adr): ADR-0131 D3 — position→permission-set binding is definition, ruled; the org-level binding table recorded as a rejected alternative

docs(adr): ADR-0131 D2/D3 — two authoring doors: Studio (metadata capability) and Setup (security-admin authority, open under single, refused under a wall); Setup editor parity is a C9 acceptance c…

chore: drop the empty changeset — docs-only PRs carry the skip-changeset label instead (#4898)

docs(adr): ADR-0131 D6 — how far clone-to-customize reaches, by type; behavioural items are not customizable under managed; the supersede shape recorded for a future pull

docs(adr): ADR-0131 D6 — managed definitions sealed, ADR-0126's regimes stand at environment scope (amended, not superseded); the standard-package scenario; C0 re-scoped to the column fix

docs(adr): ADR-0131 D10/D14 — the v18 migration is a manual operator ceremony (plan / backup / apply / post-check) with a boot refusal behind it, never an automatic boot step

docs(adr): ADR-0131 §7 — cite the drifted line as a number, not a file:line anchor (check-adr-symbol-anchors)

Merge remote-tracking branch 'origin/main' into claude/discussion-13564-a38847

docs(adr): ADR-0131 §8 — #14096 ruling: the seed paths' namespace exemption is withdrawn (C1); its eight objects are C7's first named fate-3 members