Repository navigation
docs(adr): true up ADR-0093 to as-built (descope console banner, ratify migration scope) - #2919
Merged
Merged
Conversation
…ified consumer-migration scope) Follow-up doc-truing after PRs #2884/#2887 shipped: - D5: the degraded-state "Setup dashboard banner" is descoped. Branding is the terminal boot warning + features.degradedTenancy in /auth/config (no objectui console UI for this extreme, opt-in-past-a-refusal case). The API flag stays so a console CAN render a banner later without more framework work. - D4: record actual migration status. SecurityPlugin, /auth/config, and the reconciler consume the tenancy service. The SQL driver's tenant-audit gate (a dev-only warning; the driver holds no service handle) and serve.ts boot guard (runs before the service is registered) keep reading the env flag BY DESIGN — ratified, not pending. Deferred migration, if ever, pushes the value in at wiring time rather than the driver reaching into the registry. - tenancy-modes.mdx: same descope correction for consistency. Docs-only; no package source touched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XbLd2KKeVs39EztDYMQ1YU
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
os-zhuang
marked this pull request as ready for review
July 14, 2026 14:00
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docs-only follow-up after ADR-0093 shipped (#2884 / #2887). Keeps the ADR honest with what was actually built and decided — no code.
Why
Two spots in ADR-0093 described an intended state that the implementation deliberately diverged from. Left as-is, a future contributor would "finish" work that was consciously descoped, or read a migration as incomplete when it's ratified.
Changes
1. D5 — descope the Setup-dashboard degraded banner.
The ADR promised degraded branding on "boot banner,
/auth/config, and the Setup system-overview dashboard." Per product decision, the console banner is cut: it lives in objectui (separate repo/build), and this is an extreme misconfiguration a CE self-host only reaches by explicitly opting past a boot-time refusal — the terminal warning + the API flag reach the operator who set the flag.features.degradedTenancystays in/auth/config(zero-cost) so a console can add a banner later without more framework work, but shipping that UI is out of scope. (Mirrored intenancy-modes.mdx.)2. D4 — record actual consumer-migration status, and ratify the two non-migrations.
tenancyservice: SecurityPlugin RLS gate,/auth/configfeatures, the reconciler.requestedflag. The driver holds noPluginContext/service-registry handle, and the gate governs only a dev-time "no tenantId" warning — never the enforcement path (applyTenantScope, which keys offoptions.tenantId). Coupling a low-level driver to a kernel service to fire a warning is the wrong trade; if ever done it should be pushed in at wiring time.serve.tsboot guard reads the env flag directly by necessity — it runs before plugin-auth registers the service (it's the code deciding whether to load the org runtime at all).Verification
Prose-only edits to
docs/adr/0093-*.mdandcontent/docs/deployment/tenancy-modes.mdx. No package source touched (no changeset expected; will add an empty one if the Check Changeset gate requires it).🤖 Generated with Claude Code
https://claude.ai/code/session_01XbLd2KKeVs39EztDYMQ1YU
Generated by Claude Code