From 9c09c5e1ce9610b52754517419937dbb0bd8e82b Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 04:52:55 +0000 Subject: [PATCH] =?UTF-8?q?docs(adr):=20ADR-0105=20status=20flip=20?= =?UTF-8?q?=E2=80=94=20Phase=202=20D8/D9=20implemented,=20D8's=20role=20ch?= =?UTF-8?q?annel=20closed=20by=20ADR-0108?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The status line still read 'Phase 0/1 implemented' while both Phase 2 product decisions had landed on 2026-07-28: D8 end-to-end (#3645 host seam, #3663 placement engine, #3674 my-delegable-scope, #3695 issuer-grant resolution, #3722 delegated_admin + invitation role cap closing #3697, #3767 sys_member governed) and D9 (#3824, refusal path restored in #3873), with the D9 section already amended in-PR. Cross-reference ADR-0108, which closes the membership-role vocabulary D8's placement model replaces. Tracking: #3541 Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01HY3STSsNLWuivhj1L81a5S --- .changeset/adr-0105-status-phase2-d8-d9.md | 7 +++++++ ...0105-group-tenancy-posture-and-first-class-org-scope.md | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 .changeset/adr-0105-status-phase2-d8-d9.md diff --git a/.changeset/adr-0105-status-phase2-d8-d9.md b/.changeset/adr-0105-status-phase2-d8-d9.md new file mode 100644 index 0000000000..2cb7b639b6 --- /dev/null +++ b/.changeset/adr-0105-status-phase2-d8-d9.md @@ -0,0 +1,7 @@ +--- +--- + +Docs-only: record in ADR-0105's status line that Phase 2 D8 (scoped +invitations, #3645/#3663/#3674/#3695/#3722/#3767) and D9 (cross-org approval +targeting, #3824/#3873) are implemented, and that the membership-role channel +D8 replaces is closed by ADR-0108. Releases nothing. diff --git a/docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md b/docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md index 31824bad83..e6e12c4356 100644 --- a/docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md +++ b/docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md @@ -1,6 +1,6 @@ # ADR-0105: Group Tenancy Posture — Organization Scope as a First-Class Authorization Dimension -**Status**: Accepted (2026-07-27; proposed 2026-07-25) — Phase 0/1 implemented (#3559). Amended 2026-07-27: **D12 correction** — `group` posture activation is entitled, not open (#3570; see the D12 Amendment) +**Status**: Accepted (2026-07-27; proposed 2026-07-25) — Phase 0/1 implemented (#3559). Amended 2026-07-27: **D12 correction** — `group` posture activation is entitled, not open (#3570; see the D12 Amendment). Phase 2 **D8** and **D9** implemented 2026-07-28 — D8: #3645 (host seam) → #3663 (placement engine) → #3674 (`/security/my-delegable-scope`) → #3695 (issuer-grant resolution) → #3722 (`delegated_admin` + invitation role cap, #3697) → #3767 (`sys_member` governed), console objectui#2868/#2891, e2e cloud#886; the membership-role channel D8's placement replaces is closed by [ADR-0108](./0108-membership-grade-is-not-a-capability-channel.md). D9: #3824 + #3873 (see the D9 amendment below). D10 stays reserved pending its follow-up ADR; D13 not started **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove), [ADR-0057](./0057-erp-authorization-core-business-units-and-scope-depth.md) (business units + scope depth), [ADR-0066](./0066-unified-authorization-model.md) (unified authz, superuser bypass), [ADR-0086](./0086-authz-metadata-config-boundary-and-cross-package-composition.md), [ADR-0090](./0090-permission-model-v2-concept-convergence.md) (permission set / position / business unit), [ADR-0091](./0091-grant-lifecycle-and-recertification.md) (validity windows), [ADR-0092](./0092-sys-user-profile-field-delegation.md) (identity write guard + field whitelist), [ADR-0093](./0093-tenancy-mode-and-membership-lifecycle.md) (tenancy service), [ADR-0095](./0095-authz-kernel-tenant-layer-and-posture-ladder.md) (tenant Layer 0, posture ladder), [ADR-0103](./0103-managedby-write-policy-and-engine-write-guard.md); cloud ADR-0016 (open/paid boundary: 强制免费、治理收费), cloud ADR-0081 (`@objectstack/organizations`) **Tracking**: #3541 (P0 findings F1/F2 became #3539/#3540, closed by #3559); cloud-side tracking cloud #874