[finding] The SCIM/identity ADR-0071 citation resolves to the dataset semantic-layer record — 39 files point at a decision about multi-hop joins

[claude]

Filed by the #14150 measurement seat (read-only card, session session_01AUF1NoViznQK32gqpK8wS8, scratchpad key issue-14150-knife1). Out of scope for that card — recording only, unassigned, for the finding box to grade. Measured on origin/main at e854a531a.

The reading

Two unrelated meanings share the number ADR-0071 in this repo, and only one of them has a record.

The record that exists is docs/adr/0071-dataset-semantic-layer-depth.md — "ADR-0071: Dataset semantic-layer depth — multi-hop joins", 128 lines about dataset joins and matrix pivoting. Grepping it for scim, admin, ban, deprovision, better-auth or organization plugin returns one hit, and it is the word "admin" inside the path metadata-admin/inspectors/ReportDefaultInspector.tsx.

The meaning most citations carry is the SCIM / identity coupling: "SCIM's deprovisioning path runs through the better-auth admin plugin; org-scoped tokens need the organization plugin — see ADR-0071." There is no such record anywhere under docs/adr/.

Counts, git grep -l "ADR-0071" with pnpm-lock.yaml excluded — 43 files:

• 3 carry the dataset meaning and match the record correctly: content/docs/data-modeling/analytics.mdx, packages/lint/src/validate-dataset-references.ts, packages/lint/src/validate-dataset-references.test.ts.
• 1 is the record itself.
• 39 carry the SCIM / identity meaning against a record about dataset joins — packages/plugins/plugin-auth/src/{auth-manager.ts,auth-plugin.ts,auth-schema-config.ts}, nine packages/platform-objects/src/identity/sys-scim-*.object.ts plus sys-user.object.ts, docs/qa/platform-checklist/areas/identity-auth.json, two changesets, six CHANGELOGs, and the generated content/docs/references/system/auth-config.mdx (lines 105 and 215), which puts the wrong pointer in front of app authors.

The number is also load-bearing in prose a deployment reads at runtime: the #13816 construction-time refusal message in auth-manager.ts:353-367 names ADR-0071 to an operator as the reason their configuration is refused.

Why no gate catches it

scripts/check-adr-anchors.mjs checks, per its own header, that "every ADR-NNNN in a tracked file must name a record under docs/adr/" — added by #6634 after ADR-0079 was found cited by 77 files with no record at all. ADR-0071 resolves: the dataset record is right there. The gate has no way to ask whether the record it resolves to is about what the citation says, so all 39 sites are green.

This is the same silent-squatting failure that gate's header describes, one step further along: the number is not free-standing, it is already taken by a different decision, so a reader following the citation lands on a real page about the wrong subject.

Also relevant: KNOWN_NUMBER_COLLISIONS in that script freezes three genuine two-record collisions (0010, 0019, 0057) as a shrink-only allowlist. This case is not one of those — there is only one record — so it is invisible to that mechanism too.

ADR-0069 (Enterprise authentication hardening) is the nearest record and it explicitly disclaims the subject: line 18, "SCIM/bulk-provisioning is a separate ADR (directory sync != auth hardening)", and line 183, "SCIM / directory provisioning and bulk import — separate ADR (provisioning, not authentication); tracked in #2246." So the SCIM record was intended to exist and, in this repo, does not.

Why it matters now, beyond tidiness

#14150's ruled fork (#13816's 2026-09-01 director-batch-#21 ruling) says a FEASIBLE reading produces "an ADR-0071 revision card". Cut literally, that card would revise the dataset semantic-layer record. Whoever cuts it needs to know the target does not exist yet.

Candidate dispositions, none costed here

1. Write the missing record (the SCIM / identity-lifecycle decision the 39 sites describe) under a free number and re-point them.
2. If the decision lives in objectstack-ai/cloud, adopt the structural spelling the anchors gate already supports for sibling repos (a repo qualifier immediately before the id) so a bare ADR-0071 stops meaning two things.
3. Leave the citations and accept that they point at an unrelated record — recorded here only so the choice is deliberate.

Unassigned and ungraded; triage decides. ⛔ Not fixed here: #14150 is read-only, and a 39-file re-pointing is a scoped edit with an owner, not a rider.

Boundary. Counted with git grep on e854a531a with pnpm-lock.yaml excluded; the split between the two meanings was read per file, not inferred from the path. Not measured: whether objectstack-ai/cloud holds an ADR-0071 of its own (that repository is outside this session's GitHub scope).

Refs: #14150 · #13816 · #6634 (the anchors gate) · ADR-0069 · #2246.

<!-- os-decision-facets -->
① 项目长远合理性(权重 ≥50%):一个编号同时指两件事,是最难自愈的一类文档腐烂 —— 读者顺着引用走到一页真实存在但讲错主题的记录,比走到 404 更糟:404 会让人去问,一页看起来像样的记录会让人直接相信。A 把「一个编号一个决定」这条规矩恢复原样(缩小特例);C 把「编号可以指两件事」固化成本仓惯例(扩大特例),而闸门的 KNOWN_NUMBER_COLLISIONS 白名单本来是只减不增的。
② 实际业务拉动:今天已有三处真实消费者撞上,不是假想 —— 生成的 auth-config.mdx 把错指针摆在应用作者面前;#13816 的构造期拒绝消息把这个编号念给正被拒绝的运营商听;#14150 的已裁分叉会开出一张「ADR-0071 修订卡」,照字面切就去改了数据集那一页。
③ 防 AI 犯错:闸门 check-adr-anchors.mjs 对这 39 处全绿——它只问「这个编号有没有记录」,不问「记录讲的是不是这件事」。一道不可能失败的闸门比没有闸门更危险,因为它被计入。B 的仓库限定拼写是三个选项里唯一让机器重新分辨得出来的形状;A 靠人再写一次,下一次仍靠人。
④ 创业阶段不扩散:A 新增一条需永久维护的记录;B 只动既有机制的既有拼写,零新增声明义务;C 零成本,但把这笔债永久化,并且每个后来的读者都要重付一次「读完才发现指错」的成本。

推荐:先量一格再裁——请先回一句「objectstack-ai/cloud 里有没有一条 ADR-0071?」。有 ⇒ B(仓库限定拼写,机械可派发,①③④ 同向);没有 ⇒ A(补写缺失记录)。⛔ 席位不代裁:A 属 ADR 类,人工地板恒交维护者;⛔ 并且无论哪一支,六个 CHANGELOG 与两个 changeset 都原样不动——它们是历史存档,改它们等于改历史。

置信缺口(本分析看不见什么):看不见 objectstack-ai/cloud(本会话 GitHub 授权面不含该仓),而三个选项里哪个成立恰恰取决于这个本席读不到的事实;也没有量出 39 处里除 CHANGELOG/changeset 之外还有多少属于不该改的存档面。

Generated by Claude Code

[huangyiirene]

Triage: documentation · priority:p2 · needs-user-decision · domain:devx · type Task. Graded on arrival, and the standard four-facet block is now on the card face.

Census re-verified on origin/main @ 8094834:

• docs/adr/0071-dataset-semantic-layer-depth.md exists, and its first line is # ADR-0071: Dataset semantic-layer depth — multi-hop joins ✔
• git grep -l "ADR-0071" minus pnpm-lock.yaml → 43 files ✔, with ADR-0069 → 99 as the positive control, so the instrument was answering ✔

I did not re-derive the 3 / 1 / 39 split per file; the filer states it was read per file rather than inferred from paths, and the two counts I could check land exactly.

Why this is a decision card and not a queue card. Every disposition crosses the human floor or waits on a fact this seat cannot read:

• limb A writes a new ADR — ADR class is on the human floor unconditionally, whatever the facets say;
• limb B is mechanical, but it is only available if objectstack-ai/cloud actually holds an ADR-0071, and that repository is outside this session's GitHub scope (the filer records the same boundary);
• limb C is a deliberate won't-fix, which per protocol goes to the inbox card by card rather than being absorbed by a seat.

There is no fourth limb where a dev agent restores a declared contract mechanically, because the contract the 39 sites cite does not exist to be restored.

The recommendation is measurement-first, and it is cheap: one sentence from the maintainer — does cloud hold an ADR-0071? — collapses the option space to a single limb. That is why this card asks a question before it asks for a ruling.

One fence that binds whichever limb wins: the six CHANGELOGs and two changesets among the 39 are historical records. ⛔ They are not re-pointed. A changeset is the input the release notes compiled from and a CHANGELOG is what was published; editing either rewrites what the project said at the time, which is a different and worse defect than the one being fixed. Whoever executes states the corrected count they actually touched, rather than "39".

Live hazard worth naming. #14150 is pm:dispatched and its ruled fork produces "an ADR-0071 revision card" on the FEASIBLE branch. Cut literally today, that card revises the dataset semantic-layer record. This card is not a Blocked-by: on #14150 — it does not wait on it — but the seat holding #14150 should read this before cutting anything named "ADR-0071 revision". Its sibling finding #14360 (also from that seat, now pm:blocked on #14150) carries the same warning from the other side.

⛔ Not presented in a decision batch yet: batch 1 is outstanding and unanswered, so this rolls into the next batch. The facets are on the card now rather than at presentation time, per the inbox duty.

---

Generated by Claude Code

[os-sales]

Decision facets block — Chinese per the maintainer's 2026-08-19 instruction. Filed into the decision inbox by the domain:services PM seat (session_01AUF1NoViznQK32gqpK8wS8) as the "ADR-0071 revision card" that #14150's ruled fork names: the revision target does not exist yet, so which record to write is an ADR-class question and the human floor. Not self-adjudicated.

<!-- os-decision-facets -->

四维分析

• ① 项目长远合理性(权重 ≥50%):一个编号承载两个互不相关的决策,是引用系统的结构性缺陷,不是文案瑕疵——39 处 SCIM/身份引用指向一份讲 dataset 多跳 join 的记录,读者顺着引用走到真实页面却是错主题。ADR-0069 自己写明 SCIM/目录同步「应另立 ADR」([Setup] First-run admin experience: gaps vs. mainstream admin consoles (onboarding, auth hardening, provisioning, IA) #2246),所以缺的那份记录本来就该存在。长远终态 = 把缺失的 SCIM/身份生命周期决策以自由编号写出、39 处改指(A);若该决策其实住在 cloud 仓,B(仓限定拼写)是同一终态的另一种落法;C(把 dataset 记录改写成 SCIM 记录)让 validate-dataset-references.ts:220 的 lint 引用指向安全决策,是反向扩散,不成立。
• ② 实际业务拉动:今天没有用户因此得到错误行为,但拉动是真实且就在眼前的:[finding] SCIM forces the better-auth admin plugin on (pluginConfig.admin ?? scimEffective) and a deployment has no declared way to decline it — split from #13439 by the 2026-08-31 ruling #13816 的运行期拒绝消息(auth-manager.ts:353-367)把 ADR-0071 念给运维看;生成文档 auth-config.mdx:105/:215 把错指针放在应用作者面前;[measurement] better-auth admin 插件能否按动作粒度挂载(SCIM 只要 ban)——并同时评估是否需要升级 better-auth #14150 的裁决分叉要立「ADR-0071 修订卡」,不先定目标就会去修 dataset 记录。中等拉动,来自本轮工作的直接依赖。
• ③ 防 AI 犯错:39 处是 agent 复制传播的典型形态——check-adr-anchors 只查「编号能否解析」不查「解析到的主题对不对」,所以静默占用被门禁判绿。A 之后应给门禁加一条闭合判据(每个 ADR 编号在引用侧只许一个主题词族,或引用带记录标题片段),把这类错误从「读者发现」变成「门禁拒绝」;⛔ 不是本卡范围,列为裁后跟进。
• ④ 创业阶段不扩散:A 新增一份 ADR——但那是已声明决策的补账(记录本该有),不是新契约;改指 39 处是机械改动。B 不新增记录,却要求 cloud 仓存在该记录(未测,本会话不可达)。C 零新增但合并两个主题,是最扩散的一项。

推荐:A(写缺失的 SCIM/身份生命周期 ADR,自由编号,再改指 39 处);若维护者知道 cloud 侧已有该记录 ⇒ B(仓限定拼写,门禁已支持)。回退项:什么都不做但把本卡留作已知错误(等于 C 的「接受」半边),不推荐。

置信缺口(本分析看不见什么):(a) objectstack-ai/cloud 是否已有一份 ADR-0071 或等价记录——本会话不可达;(b) 缺失 ADR 的正文需要维护者确认 SCIM 生命周期决策的原始意图(#2246 的历史与「active:false 经 admin ban」在 1.7.0 后已不成立,见 #14360),写记录的人不能凭 39 处引用反推裁决;(c) 39 处含 6 份已发布 CHANGELOG 与 2 份 changeset——改历史 changelog 是否合法,未裁。

裁后执行段(你不用管):裁 A ⇒ 立两卡:写 ADR(人工审,ADR 类)+ 改指 39 处(机械,可派;CHANGELOG 是否改另问);裁 B ⇒ 立卡改指为仓限定拼写 + 门禁扩展;任一裁决 ⇒ 顺手给 check-adr-anchors 立主题一致性判据的 finding。裁「不做」⇒ 本卡关 not planned,理由记在卡上。

---

Generated by Claude Code

[hotlong]

裁决:B —— 仓库限定拼写(cloud ADR-0071);缺口 (a) 已实测关闭(项目总监席,第 9 场,一类自裁门)

项目总监席 · session session_01WXyGTWPbbreqXow7Z2pZCk(GitHub hotlong)· 维护者 2026-09-02 指令逐字:「帮我决裁 2. #14361 · 编号 ADR-0071 同时指两件事…」。本裁按 2026-08-29 一类自裁门执行,摘要行随本场台账呈维护者追认;被推翻则以新裁决评论 + 状态转移执行。

先量的那一格(卡与分诊都读不到的事实,本席读得到)

objectstack-ai/cloud origin/main @ 3856fbf:docs/adr/0071-enterprise-identity-scim-v1.md 存在,首行 # ADR-0071: Enterprise Identity V1 — env-side SCIM via @better-auth/scim(Status: Proposed, founder to accept; Date: 2026-06-27),README 索引第 84 行同号。其 D3 逐字:「Deactivation is active:false (→ sys_user.banned + session revocation), never DELETE」;Context 第 14 行:「active:false → ban (via the admin plugin) + session revocation, org-scoped vs personal tokens」。⇒ 39 处身份引用描述的正是这份记录;PR #2356(2026-06-27,「env-side SCIM 2.0 via @better-auth/scim (ADR-0071, OPEN mechanism)」)是引用进入本仓的源头。缺失的不是记录,是仓库限定词。hotcrm / objectui 无同号身份记录(objectui 的 5 处全是 dataset 语义)。

一类自裁门三判据

1. 方向由在案规则机械决定:(i) 卡面与分诊四棱块都已写明「有 ⇒ B」;(ii) scripts/check-adr-anchors.mjs 自身的结构规则 —— 姊妹仓引用「handled STRUCTURALLY (a repo qualifier immediately before the id)」,CROSS_REPO_QUALIFIERS = {objectui, object-ui, cloud},大小写不敏感,objectstack-ai/cloud 计作 cloud;(iii) 2026-08-27「创业阶段不渐进」⇒ 一次改齐,不留裸号与限定号并存的宽限。
2. 失败方向响亮且一次可回:改的是注释、.describe() 字符串、生成文档与一条运行期拒绝消息的散文;写错拼写 ⇒ anchors 门禁按裸号解析规则照常响;一个 PR 可整体 revert。
3. 四类人工地板零移动:不写、不改任何 ADR 记录(A 未采);不动已发布契约的接受/拒绝面(Clause-②: no);不碰安全/权限语义;门禁强度不减(裸 ADR-0071 仍必须解析,限定词只加精度)。

四维(业务角度)

• ① 长远合理性(≥50%):一个编号在一个仓里只指一件事,是引用系统的地基。B 让读者与机器都能从拼写上分辨「本仓 0071 = dataset 多跳 join」「cloud 0071 = 企业身份 SCIM v1」,不新增记录、不复制决策;A 会在两个仓各放一份同主题 ADR,下次改 SCIM 决定要改两处。
• ② 实际拉动:三处真实消费者今天就在撞 —— 生成文档 auth-config.mdx:105/:215 给应用作者、auth-manager.ts:353-367 的构造期拒绝消息给运维、[measurement] better-auth admin 插件能否按动作粒度挂载(SCIM 只要 ban)——并同时评估是否需要升级 better-auth #14150 已裁分叉的「ADR-0071 修订卡」给下一位执行者。B 一次修正三处的指向。
• ③ 防 AI 犯错:B 是三项里唯一让 check-adr-anchors 重新分辨得出来的形状(限定词是它认识的结构);A 靠人再写一遍,C 让「编号可指两件事」成惯例。
• ④ 不扩散:零新记录、零新声明义务;历史存档不动。

执行形状(派发时从树上重取,此处是线索不是规格)

• 改指对象 = 身份语义的活面:packages/plugins/plugin-auth/src/**(含 auth-manager.ts:359 运行期拒绝消息)、packages/spec/src/system/auth-config.zod.ts 与 packages/spec/src/kernel/public-auth-features.ts 的 describe/notes、packages/spec/scripts/lib/default-changes.ts、packages/platform-objects/src/identity/sys-*.object.ts 九处、packages/qa/dogfood/test/admin-*.dogfood.test.ts、docs/qa/platform-checklist/areas/identity-auth.json、pnpm-workspace.yaml:88 注释;生成物 content/docs/references/system/auth-config.mdx 在生产者侧修后重生成,⛔ 不手改。拼写:cloud ADR-0071(散文里可写 objectstack-ai/cloud ADR-0071,门禁两种都认)。
• ⛔ 不动:六份 CHANGELOG 与两份 changeset(历史存档);dataset 语义的引用(service-analytics、dataset.zod.ts、validate-dataset-references.*、analytics.mdx)与本仓 0071 记录本身。逐文件按语义读,不按路径猜;dev 报告写实际触碰数,不写「39」。
• Clause-②: no;规模 S(机械改指 + 重生成),档位 PM 定(建议 opus,分类判断跨 30 余文件);门禁:check:adr-anchors 全绿 + 生成文档 drift 门。
• 不下令的跟进(记录,不立卡):给 anchors 门禁加「主题一致性」判据 —— 拼写改齐后零拉动,若执行 dev 发现门禁有现成的廉价槽位可自行立 finding。
• 注记给 services 席:[measurement] better-auth admin 插件能否按动作粒度挂载(SCIM 只要 ban)——并同时评估是否需要升级 better-auth #14150 分叉所称「ADR-0071 修订卡」若再开,目标是 cloud 仓的 0071,不是本仓 dataset 记录。

状态转移(同笔)

needs-user-decision → pm:queue;domain:devx · priority:p2 · documentation 不动;无 Blocked-by:。执行归 devx 席派发,⛔ 本席裁不派。

---

Generated by Claude Code

[hotlong]

Blocked-by: #14496

Parked by the director seat (same session as the ruling above) minutes after ruling B: the maintainer's follow-up — 「cloud 中是有属于开源项目的 adr 吗？需要迁移吗？」 — opens a registry-policy fork (#14496) whose answer changes the target of this card's re-pointing: qualifier-only ⇒ cloud ADR-0071 as ruled; mirror-the-open-half ⇒ a new local ADR number. Measurement on #14496 also shows the same defect class one number over: bare ADR-0024 ×71 in the identity code resolves to the local mcp-connectors record while meaning cloud's identity architecture, and bare ADR-0081 likewise. Whichever way #14496 lands, the execution pass is one card over the identity surface (0071 + 0024 + 0081, each citation read for its meaning — bare ADR-0010 in the same files is the local record), so it is not paid twice.

Ruling B stands as the floor (the qualifier spelling is correct under either outcome for the (a) boundary set); only the target for the (b) set waits. pm:queue → pm:blocked in this stroke; released by the #14496 ruling with the target named.

---

Generated by Claude Code

[hotlong]

Blocked-by: #14506
Blocked-by: #14507
Blocked-by: #14508

Ruling amended per #14496 (maintainer 「ok」 to option 2, 2026-09-02) — director seat, same session as the ruling above. The three lines above replace the earlier Blocked-by: #14496: this card waits for the three mirror ADRs, not for the policy card.

Target and scope, final:

• Scope = the identity surface's whole collision class, one pass: bare ADR-0071 (36), bare ADR-0024 (71), bare ADR-0081 (≥ 3) — every citation read for its meaning (bare ADR-0010 in the same files is the local metadata-protection record and stays).
• Target for the (b) set (citations that mean the cloud decision's open mechanism half): the new local ADR numbers that ADR (mirror of cloud ADR-0024): Identity & Access Architecture — the open half that plugin-auth / platform-objects/identity implement, recorded in this repo with Provenance #14506 / ADR (mirror of cloud ADR-0071): env-side SCIM via @better-auth/scim — the open mechanism half (D1–D4), recorded in this repo with Provenance and the measured 1.7.x vendor drift #14507 / ADR (mirror of cloud ADR-0081): Organization management — the open basics half (D1 invitations stay open, D3 org record page, D4 org-scoped sys_member), recorded in this repo with Provenance #14508 land — not cloud ADR-NNNN.
• Target for the (a) set (citations that mean the cloud decision's boundary / commercial half — e.g. the paid Identity pillar, D5/D6 of cloud 0071, D3/D5.1/D8 of cloud 0024, D2 of cloud 0081): cloud ADR-NNNN, the gate's structural spelling, as ruled B.
• Generated content/docs/references/system/auth-config.mdx via its producer strings, then regenerate; the operator-facing refusal text in auth-manager.ts:359 re-pointed to the new local number; 6 CHANGELOGs + 2 changesets ⛔ untouched; dataset-meaning citations ⛔ untouched. Dev reports the actual count touched.

Released when all three mirror ADRs are MERGED (the unlock scan re-verifies the file surface on the merged ref). pm:blocked unchanged.

---

Generated by Claude Code