Skip to content

docs(adr): ADR-0131 §1.2(3) — the precondition is reachable and reported at boot, not a refused boot #17544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-zhuang merged 1 commit into from
Sep 11, 2026
Merged

docs(adr): ADR-0131 §1.2(3) — the precondition is reachable and reported at boot, not a refused boot #17544

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions docs/adr/0131-total-organization-ownership-no-null-organization-id.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,8 +129,14 @@ this arm, on a control plane whose requested `isolated` posture had degraded to
`{ isSystem: true, tenantId }` passes.
2. On a walled deployment running `plugin-security`, tenants already do not see NULL rows — Layer 0's
strict equality ANDs over the arm and wins (#10103's symptom, the other face of the same coin).
3. The measured leak's precondition — many organizations with Layer 0 inert — is today a refused boot
([ADR-0093](./0093-tenancy-mode-and-membership-lifecycle.md) D5, cloud#1020, cloud#1664).
3. The measured leak's precondition — many organizations with Layer 0 inert — is **reachable today**,
not a refused boot: a deployment that never *requests* a walled posture and merely *holds* more
than one `sys_organization` row under `single` boots and serves. Since #17010 (PR #17460)
`TenancyService` takes a `count(sys_organization)` census and **reports** that state at `error` at
boot — naming the posture the deployment declared, the count it holds and the two remedies — and
does not refuse it; [ADR-0093](./0093-tenancy-mode-and-membership-lifecycle.md) D5 refuses the
different case of a *requested*-but-absent wall (cloud#1020, cloud#1664). The discount this item
gives the leak therefore rests on a reported state, not a refused one.
4. Beyond `sys_position`'s authorization read and the catalog's residue detection, the #12699
deployment-level platform-global declaration depends on the arm: it disarms Layer 0 only, so a
tenant's read of a declared-global object sees the deployment's NULL rows *through the driver*
Expand Down
Loading