Skip to content

docs(adr): ADR-0060 P3 — landed-bar in force; status Accepted #2106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xuyushun441-sys merged 1 commit into from
Jun 21, 2026
Merged

docs(adr): ADR-0060 P3 — landed-bar in force; status Accepted #2106

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 28 additions & 3 deletions docs/adr/0060-conformance-ledger-platform-pattern.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# ADR-0060: Conformance Ledger as a Platform Pattern

**Status**: Proposed (2026-06-21)
**Status**: Accepted — P1–P2 implemented; D5 landed-bar in force; D6 (CI aggregate) deferred (2026-06-21)
**Deciders**: ObjectStack Protocol Architects
**Builds on**: ADR-0049 (enforce-or-remove / no unenforced declaration), ADR-0054
(runtime proof per enforced high-risk primitive), ADR-0056 D10 (Authorization
Expand Down Expand Up @@ -171,8 +171,33 @@ shared invariants, independent ratchets, additive.
authz + expression ledgers onto it (tests stay green; proves reuse).
- **P2** — D3 validation-rule-surface ledger + ratchet; classify every rule type,
pin the ADR-0020 `state_machine` enforcement with a proof.
- **P3** — D5 as the documented "landed" bar; D6 CI aggregate; extend to the next
highest-risk surfaces (flow conditions, UI actions, connectors) as evidence warrants.
- **P3** — D5 as the documented "landed" bar (**done** — see Implementation status);
D6 CI aggregate **deferred** (each ledger self-gates); extend to the next highest-risk
surfaces (flow conditions, UI actions, connectors) as evidence warrants.

## Implementation status (2026-06-21)

P1–P2 landed; the pattern is proven across **three** surfaces sharing one helper:

| Surface | Ledger | Discover / ratchet | Enforcement |
| :-- | :-- | :-- | :-- |
| Authorization (ADR-0056 D10) | `authz-conformance.matrix.ts` | curated primitives | plugin-security / plugin-sharing |
| Expression (ADR-0058 D7) | `expression-conformance.ledger.ts` | every `ExpressionInputSchema` field in spec | `@objectstack/formula` compiler |
| Validation rules (ADR-0020) | `validation-conformance.ledger.ts` | every `validations` union rule type | `objectql` rule-validator |

Helper: `@objectstack/verify` → `checkLedger(rows, opts)`.

**D5 — the "landed" bar (in force).** A declaration surface is **landed iff it has
a conformance ledger whose `checkLedger` ratchet is green.** Adding a new authorable
surface (a new `ExpressionInputSchema`-style family, a new `validations` rule type,
a new authz primitive) without a ledger row is, by construction, an unclassified-
surface CI failure. This is ADR-0049's "enforce or remove" with a mechanical third
leg: **ledger or it isn't landed.**

**D6 — CI aggregate: deferred.** Each ledger already gates itself in CI, so a single
aggregate meta-test adds little beyond a registry of registries. It is deferred until
the surface count makes a one-call "is the whole conformance surface green?" worth the
indirection.

## References

Expand Down