decision: ADR-0131 C2/C3 order — C2 must read positions' permission sets, which only C3 adds, while §8 makes C3 wait on C2. Which way is the knot cut? #22006

Activity

1. objectstack-fleet

   added

   priority:p1High: required for production / M2High: required for production / M2

   needs-user-decisionBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PRBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PR

   target:v18

   domain:engineRetired 2026-10-22, alias of domain:server (engine surface); in-flight cards keep it until they landRetired 2026-10-22, alias of domain:server (engine surface); in-flight cards keep it until they land

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   on Oct 6, 2026
2. objectstack-fleet commented on Oct 7, 2026

   

   objectstack-fleetBot

   on Oct 7, 2026

   ContributorAuthor

   More actions

   Ruling: batch #283 item 4 · letter B · maintainer 「其他同意」 2026-10-07T01:17Z

   Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Batch #283 was presented in chat with this card's options A / B / C; the maintainer answered 「其他同意」 for the four cards of the batch whose recommendation stood, this one among them, which takes B. Freshness gate: the body (no comments) and both parents' threads (#15196: re-verification 6018633315; #15204: re-verification 6018622568) were re-read before this record; nothing newer exists. Thread-read: none on this card.

   The ruling

   B. C2 (#15196) moves every catalog read to the registry EXCEPT the position-to-permission-set relation, which keeps reading sys_position_permission_set until C3. C3 (#15204) then lands the field and its only reader together: PositionSchema.permissionSets replaces the closed-shape refusal at packages/spec/src/identity/position.zod.ts:51, the rows migrate into the position definitions, the read switches, and the join table retires. ADR-0131 §8 keeps its order (C3 after C1 and C2). ⛔ Not taken: A (the field lands in C2 and the read merges two sources for a transition window, where the two can disagree and silently change a permission result) and C (one XL change set that is harder to review and to roll back).

   Why B: the end state is the same under all three, and under B there is never a moment with two sources of truth for which permission sets a position carries, a relation read on every permission computation. It matches Salesforce's Permission Set Group modelling, where the membership lives in the definition.

   State

   • This card closes completed in this act; pointers are recorded on feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 and refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204, both pm:blocked on target:v18. The triage seat carries the ruling into the two card faces at the v18 re-verification: C2 keeps the one legacy read, C3 gains the field, the migration and the read switch. Scope sizes were not measured by the seat.

   ---

   Generated by Claude Code
3. objectstack-fleet

   removed

   needs-user-decisionBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PRBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PR

   on Oct 7, 2026
4. objectstack-fleet

   closed this as completedon Oct 7, 2026