docs(decisions): record milestone 3 completion and the authorization boundary - #35
Conversation
…boundary The roadmap now states the current position AGENTS.md says it owns: Milestones 0-3 complete, Milestone 4 next with #32 as its design record. ADR 0010 makes the #31 review boundary durable — database backstops enforce properties of immutable record history (the self-review trigger is the model), while authorization and content semantics stay the domain services' typed, audited contracts; the rejected alternatives record why capability checks and content validation in triggers establish nothing against the writer they target. Content binding lands at Milestone 4 finalization hashes, where a verifier can actually check it. Refs #33. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DNP3dkn9c84v2YoNwx7KTg
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bf38a80b13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex review, three accuracy findings on the ADR text, all confirmed against the code. The boundary is rescoped from "immutable history only" to data invariants of the record system's own rows, so the shipped overlap and agreement backstops (0007, domain invariant 7) stand inside the rule instead of reading as violations. The capability-rename consequence now names the explicit data migration that persisted grant strings require (capability_grant stores names; bundles apply once), narrowing "never a migration" to trigger logic. And finalization hashes are no longer presented as the answer to the snapshot-content proposal: per records-integrity.md they prove internal byte/hash consistency, not provenance against a direct writer — the proposal is declined as unprovable at this trust level, with stronger binding waiting on the signed mode. Refs #33. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DNP3dkn9c84v2YoNwx7KTg
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 60ca7435a0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex review: "proves nothing" was overbroad — while a draft is frozen its rows cannot change, so a decision-time comparison of the return snapshot against the frozen rows would hold a real, narrow row-consistency property. The rejected alternative now says so and declines it as a poor trade instead of an impossibility: the comparison duplicates the snapshot format in SQL, guards one snapshot kind while the submission snapshot has no pairing at all, and the workflow anchor is already guaranteed where it is produced (service, one transaction, frozen rows). Reopening the trade is an ADR-level decision scoped to every snapshot kind at once. Refs #33. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DNP3dkn9c84v2YoNwx7KTg
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3914675432
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex review: "Milestones 0 through 3 complete" overclaimed — Milestone 0 lists "specify canonical record bytes", and records-integrity.md holds that as a design target, not a finished specification (ADR 0001 promises the decision separately). The position statement now says so: Milestones 1-3 complete, Milestone 0 complete except the canonical-bytes specification, deliberately open until Milestone 4's first design decision settles it before any record is produced. Refs #33. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DNP3dkn9c84v2YoNwx7KTg
2 participants
Primary Issue
Closes #33
Refs #22, #32
Problem And Outcome
Milestone 3 closed (#22) with two records unwritten. AGENTS.md names
docs/roadmap.mdas the owner of "milestone sequence and current position", but the file carried no position; and the #31 review twice proposed schema-level enforcement beyond record history (capability grants in decision triggers, snapshot content validation), declined on threads that are not a durable decision record. After merge, the roadmap states where the project stands and ADR 0010 makes the authorization boundary settled instead of re-litigated one table at a time.Changes
docs/roadmap.md: a current-position statement — Milestones 0–3 complete (Milestone 3 closed with Milestone 3 design: sessions, drafts, and attribution (owner decisions needed) #22), Milestone 4 next with Milestone 4 design: defensible records (owner decisions needed) #32 as its design recorddocs/decisions/0010-service-owned-authorization-boundary.md: database backstops enforce properties of immutable record history (the self-review trigger is the model — a raw writer cannot legally satisfy it); authorization and content semantics stay the domain services' typed, audited contracts; rejected alternatives record why capability checks in triggers (mutablecapability_grantrows the same writer controls — a duplicated authorization authority that establishes nothing), content validation in triggers (a second serializer authority that still proves nothing), and refusing "raw" writes as such (not expressible) all fail; content binding lands at Milestone 4's finalization hashes (Milestone 4 design: defensible records (owner decisions needed) #32, decision 1)Scope
Verification
Review And Merge Notes
🤖 Generated with Claude Code
https://claude.ai/code/session_01DNP3dkn9c84v2YoNwx7KTg
Generated by Claude Code