Activity

1. cobmojo

   added

   complexity:hardHigh complexity or scopeHigh complexity or scope

   status:blocked

   type:featureNew functionalityNew functionality

   on Oct 11, 2026
2. cobmojo

   changed the title [-]P27-S01: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships[/-] [+]AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01)[/+] on Oct 11, 2026
3. cobmojo

   added a parent issue on Oct 11, 2026

   • [Phase 9] Epic — Full CRM Depth & Relationship Graph #604
4. cobmojo

   marked this as blocked on Oct 11, 2026

   • [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606
5. cobmojo

   marked this as blocking 2 issues on Oct 11, 2026

   • AL-2001: Share a new eligible partnership update with its exact audience (P27-C01) #2001
   • AL-2004: Start or reuse one continuing partnership in context (P27-P01) #2004
6. cobmojo

   marked this as blocking on Oct 19, 2026

   • AL-2069 — [P28-W01] Enter and switch the exact authorized workspace context #2069
7. II-ricky-bobby-II

   removed

   status:blocked

   on Oct 19, 2026
8. II-ricky-bobby-II commented on Oct 24, 2026

   

   II-ricky-bobby-II

   on Oct 24, 2026

   Contributor

   More actions

   Final spec r1 (Oct 24, 2026)

   Status: pending Ready, prep only. Building starts only after Blake marks the issue Ready. This revision changes no labels and adds no Ready.

   Scope: this spec covers the Phase 9 database source for one stable Ministry Assignment and its separate Party Participant Memberships (ADR-0136, Phase 9 dated D19 amendment). As filed, the issue spans five things: source tables, write commands, the server API with Phase 12 PDP integration, the People & access UI, and a legacy census. That is well over the size caps (§10). OQ1 proposes a split. By default, #1998 keeps S1: the source schema, the append-only history, the guarded command and narrow read functions, the read-only legacy census, and real-database race and grant proof. The browser and API surfaces move to follow-ups that stay gated on the Phase 12 runtime.

   • S1 grants nothing to anon or authenticated. It has no app caller and no UI, and it adds nothing to the [Phase 4] #505 slice 4/4: CI gates: RLS catalog assertion + bare service-role client gate #2253 allowlist.
   • It can't be built today. The Party spine ([Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570 → [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606) and legal_entities ([Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947) aren't on develop (§11).

   §0 What I checked (Oct 24, 2026, about 4:35 PM PT)

   • Base: develop 6ac594d9 (Oct 24, 2:34 PM PT), after a full fetch of 41 refs. The newest migration is 20261024120000. There are 83 versioned files, plus 5 rollback_* scripts with no version.
   • Issue state:
     • Open; labels complexity:hard, type:feature. The body still says status:blocked, but that label isn't applied.
     • No comments, so no earlier Scope spec exists. This is r1.
   • Governing documents, all on develop:
     • PR docs(AL-1992): publish Phase 27 specification and implementation handoff #1993 merged Oct 11 (8:11 AM PT), so the body's "unmerged" non-issue prerequisite is satisfied. Spec commit b5a65b3f is in history.
     • docs/adr/0136-organization-owned-ministry-assignments-and-separated-support-access.md §Decision, "Database enforcement" paragraph: complete Tenant + Legal Entity scope, composite FKs, non-overlapping half-open intervals, scope-complete uniqueness and idempotency, deletion restriction, forced coarse Tenant RLS, no anon/authenticated grants on raw relations, and definer functions outside exposed schemas with a fixed search_path and PUBLIC EXECUTE revoked.
     • docs/prds/sitestacker-parity/phase-09-full-crm-depth-relationship-graph.md:1299-1341: the D19 amendment. It describes a membership as "prospective, effective-dated, append-only-corrected", and says the Ministry Assignment is distinct from Party, household, relationship edge, Ministry Project, Support Assignment and Page.
   • Catalog (scratch PG17, all develop migrations applied):
     • There is no parties, persons, households or legal_entities table, and no column named party_id or legal_entity_id anywhere.
     • missionaries has no person_id column. Its columns are id, tenant_id, profile_id, bio, …, birth_date.
     • Extensions: plpgsql, pgcrypto, uuid-ossp. No btree_gist. No migration uses EXCLUDE or tstzrange yet.
     • authz has memberships plus current_tenant_id() (JWT app_metadata.tenant_id), current_user_id(), has_membership, has_staff_membership and is_super_admin(). No PDP, epoch, grant table or principal exists on develop.
   • Name collision: public.support_assignments (20260515025814_support_hub_core_modules.sql:448) is the Support Hub conversation assignment. It is not Phase 21's Support Assignment (ADR-0108). S1 references neither.
   • Existing CRM code:
     • packages/api/src/crm/auth/access.ts:22-62: requireCrmAccess is a role bridge (staff/admin/super_admin). The issue says this "is not a substitute" for Phase 12.
     • packages/api/src/admin/crm/relationships/service.ts:51-61 reads donors/missionaries/profiles through the RelationshipsClient.
     • apps/admin/app/(app)/crm/detail-drawer.tsx (694 lines) is the CRM People surface that S3 would extend.
   • Upstream specs this builds on:
     • [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570's spec (migrations 20261024170500_party_spine, 20261024171500_party_spine_tenant_guard): parties PK (tenant_id, id), party_kind ∈ {person, household, org}.
     • [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606's spec (20261024180000_party_spine_lifecycle_tags_tombstone, 20261024181500_drop_donor_free_text_relics): parties.merged_into_party_id and lifecycle_status.
     • [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250 r1 (builder/2250-tenant-guard, 20261024150000_tenant_guard.sql): the tenant_guard NOLOGIN NOBYPASSRLS role, tenant_guard.current_tenant_id() = nullif(current_setting('app.current_tenant_id', true), '')::uuid, guarded definer functions owned by tenant_guard, TO tenant_guard policies, and a required tenant_id echo.
     • [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947 (open, no spec): owns canonical legal_entities.

   §1 Intended behavior

   A Ministry Assignment is an organization-owned row with exactly one Tenant and one Legal Entity. Its identity never changes. Its name and lifecycle change only by appending a version, under a compare-and-swap on the head version.

   A membership links one same-Tenant person Party to one assignment for one half-open interval [valid_from, valid_to). For one (Tenant, assignment, Party):

   • in-effect intervals never overlap;
   • adjacent intervals are allowed.

   Ending or correcting a membership appends a successor row and marks the old one superseded. Nothing is deleted.

   Every command:

   • is idempotent per (tenant_id, idempotency_key);
   • returns the original result for the same key and the same request hash;
   • refuses the same key with a different request hash;
   • commits its source row, history and receipt in one transaction, or nothing.

   Threat	Control in S1
   Browser or anon reads raw rows	Explicit REVOKE from PUBLIC/anon/authenticated/service_role; no grants; RLS ENABLE+FORCE
   Cross-tenant write or read through guarded functions	TO tenant_guard policies keyed on tenant_guard.current_tenant_id(); composite (tenant_id, …) FKs; tenant_id echo
   Party from another tenant, a tombstoned Party, or a non-person Party	Composite FK (tenant_id, party_id) → parties; command refuses merged_into_party_id IS NOT NULL or party_kind <> 'person'
   Legal Entity mismatch between assignment and membership	Composite FK (tenant_id, legal_entity_id, ministry_assignment_id) → assignment's UNIQUE (tenant_id, legal_entity_id, id)
   Concurrent overlapping adds	EXCLUDE USING gist over in-effect rows (needs btree_gist, OQ3)
   Lost response, retry, ABA	Receipt table; head-version CAS (versions only increase)
   Delete or rewrite of history	Triggers reject DELETE on all four tables, and reject UPDATE except the one-time supersede and head bump; FKs are ON DELETE RESTRICT
   Membership treated as a grant	No column, function or policy derives access from membership; a done criterion checks this

   Non-goals: Public Ministry Page, Support Binding Version, Phase 21 Support Assignment, Page contributors or display, notifications, finance, invitations, the PDP itself, Realtime, views, requireCrmAccess changes, inferred memberships, and writes to missionaries.person_id.

   §2 In (S1)

   1. One migration, 20261024185000_ministry_assignments_source.sql (provisional version, §11), containing:
      • CREATE EXTENSION IF NOT EXISTS btree_gist WITH SCHEMA extensions (OQ3).
      • public.ministry_assignments:
        • columns: tenant_id, id, legal_entity_id, head_version int NOT NULL DEFAULT 1, created_by_user_id, created_at;
        • PK (tenant_id, id) and UNIQUE (tenant_id, legal_entity_id, id);
        • FK (tenant_id, legal_entity_id) → legal_entities ON DELETE RESTRICT.
      • public.ministry_assignment_versions (append-only):
        • columns: display_name, lifecycle_status CHECK ('active','retired'), change_kind CHECK ('create','revise','retire','owner_certified_correction'), reason, actor_user_id, recorded_at;
        • PK (tenant_id, ministry_assignment_id, version);
        • composite FK to the assignment.
      • public.ministry_assignment_memberships:
        • columns: party_id, valid_from, valid_to (NULL = open), change_kind CHECK ('add','end','correct'), supersedes_membership_id, superseded_by_membership_id, reason, actor_user_id, recorded_at;
        • CHECK valid_to IS NULL OR valid_to > valid_from;
        • EXCLUDE USING gist (tenant_id WITH =, ministry_assignment_id WITH =, party_id WITH =, tstzrange(valid_from, valid_to, '[)') WITH &&) WHERE (superseded_by_membership_id IS NULL).
      • public.ministry_assignment_command_receipts: PK (tenant_id, idempotency_key), plus command, request_hash, result jsonb, actor_user_id and recorded_at.
      • Named constraints throughout. The three guard triggers.
      • Guarded functions in schema tenant_guard, following [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250's pattern (owner tenant_guard, SET search_path = '', every name schema-qualified, REVOKE EXECUTE … FROM PUBLIC, anon, authenticated, GRANT EXECUTE … TO service_role, each sets the GUC from p_tenant_id and echoes tenant_id):
        • ministry_assignment_create
        • ministry_assignment_revise (CAS on p_expected_version; also covers retire and correction)
        • ministry_membership_add
        • ministry_membership_end
        • ministry_membership_correct
        • ministry_assignment_current: the narrow read. It returns id, legal entity, current name, lifecycle, eligible = (lifecycle_status = 'active'), head version, and the party ids currently in effect. It never returns raw membership rows.
      • Command rules:
        • add and end are prospective (valid_from/valid_to ≥ statement_timestamp());
        • only correct may change a past interval, and it needs a non-empty reason (OQ5);
        • adds are refused on a retired assignment (OQ6).
      • Tables: ENABLE + FORCE RLS. One policy per table: "<table> tenant guard isolation" FOR ALL TO tenant_guard USING/WITH CHECK (tenant_id = tenant_guard.current_tenant_id()).
      • Grants: explicit REVOKE ALL … FROM PUBLIC, anon, authenticated, service_role. Then tenant_guard gets only SELECT, INSERT on all four tables, plus UPDATE (superseded_by_membership_id) on memberships and UPDATE (head_version) on assignments.
      • [Phase 4] #505 slice 2/4: ENABLE + FORCE RLS and at least one policy on every public tenant table #2251's fail-closed owner-bypass precondition, repeated for the four new tables.
   2. Read-only census scripts/verify/ministry-assignment-census.mjs:
      • It reads missionaries (tenant_id, id, profile_id), never * and never person_id.
      • Per tenant, it emits JSON counts: missionaries rows, rows with no Ministry Assignment mapping (today: all of them), and ambiguity classes (one profile on several rows; no Party yet).
      • It writes nothing, creates no assignment or membership, and infers nothing from names, households or URLs.
   3. docs/features/crm-ministry-assignments/README.md: the model, the commands, "membership grants nothing", and how to run the census.

   §3 Out (S1)

   • S2: the server API and Phase 12 PDP integration, with withTenant allow-list entries.
   • S3: the People & access "Associated with this ministry" UI, plus e2e and a11y.
   • The Support Binding (Phase 21), Pages and contributors ([Phase 22] P22-04 — Manage distinct Ministry Assignment, display, and contributor grants #1285), relationship edges ([Phase 9] Build the stored relationship graph: crm_relationships + seeded type catalog #607), and Realtime.
   • Edits to docs/ci.md, the [Phase 4] #505 slice 4/4: CI gates: RLS catalog assertion + bare service-role client gate #2253 allowlist, authz.*, requireCrmAccess, or missionaries.

   §4 Done criteria

   (A) Acceptance, real stack (tests/unit/acceptance/issue-1998/ministry-assignments.realstack.acceptance.test.ts; two independent pg clients; fixtures are 2 tenants, 2 legal entities, and persons, a household and a tombstoned Party):

   • a1. An assignment with zero members is created and ministry_assignment_current returns it as eligible. It needs no Page, gift, email, binding or login.
   • a2. Many-to-many: one Party belongs to 2 assignments, and 2 Parties belong to 1 assignment. A revise (rename) keeps id.
   • a3. Intervals:
     • (i) [t1,t2) then [t2,t3) both commit (adjacent).
     • (ii) Two sessions add overlapping intervals for the same key concurrently. Exactly one commits; the other gets 23P01.
     • (iii) end and correct append rows; the predecessor's superseded_by is set; row count only grows.
   • a4. Scope attacks, each refused:
     • a cross-tenant party_id;
     • a cross-legal-entity membership;
     • a mismatched p_tenant_id vs. a row id;
     • household or tombstoned Party;
     • anon/authenticated SELECT/INSERT/EXECUTE (42501);
     • service_role direct table SELECT (42501);
     • a GUC set for tenant A reading tenant B through the guard role (0 rows).
   • a5. Idempotency: the same key with the same hash returns the original ids, actor and time with no new rows. The same key with a different hash is refused. A fault injected after the first insert leaves 0 rows in all four tables.
   • a6. CAS: two sessions revise from the same expected_version. One wins; the other is refused; there is no lost update. An ABA attempt with a stale version is refused.
   • a7. Retire: eligible=false; history and memberships are kept; a new add is refused; end and correct still work.
   • a8. Grants nothing: catalog query. No policy, function or view outside the six functions references ministry_assignment_memberships, and no authz object reads it.

   (B) Unit and static (tests/unit/scripts/ministry-assignment-census.test.ts and tests/unit/supabase/ministry-assignments-migration.test.ts):

   • b1. The census selects only the three named columns. It emits unresolved counts and makes no write calls (spy).
   • b2. The migration has the REVOKE list before any GRANT, FORCE on all four tables, PUBLIC EXECUTE revoked on all six functions, search_path = '', and no is_super_admin, authz.current_tenant_id or person_id tokens.

   (S) Security

   • s1. Live-name check (READ-ONLY, the development project), Owner "Builder or Acceptance": confirm that none of the four table names, four policy names or six function names already exist, and that btree_gist availability matches OQ3. S1 drops and recreates no existing policy. Any mismatch goes to Samson before merge.
   • s2. The [Phase 4] #505 slice 4/4: CI gates: RLS catalog assertion + bare service-role client gate #2253 gate and [Phase 4] #505 slice 2/4: ENABLE + FORCE RLS and at least one policy on every public tenant table #2251 exceptions pass with no new exception entry. The allowlist is unchanged.

   (Handback) The PR body lists the test files, the commands and their results, the s1 result, the census output on the seeded DB, and Closes #1998 only if OQ1 is approved. Otherwise it uses Part of #1998.

   §5 Mapping (issue AC → S1 criteria)

   Issue AC	S1	Deferred
   Zero-participant selectable ministry	a1	UI selection (S3)
   Many-to-many, identity survives	a2	—
   Half-open intervals, concurrency, evidence	a3, a5	—
   Current authority before list/detail; attacks	a4 (DB layer)	PDP, field and purpose authority (S2)
   Membership grants nothing	a8	Independent-grant outcomes (S2)
   Retirement / owner-certified correction	a6, a7	Downstream consumption (#2004, #1285)
   Lost response / ABA / revocation race	a5, a6	Revocation race (S2, needs epoch)
   Migration census, no inference	b1, census	—
   Keyboard / screen reader / 320 px / 400%	—	S3

   §6 Declared edits

   Path	Change	Owner
   supabase/migrations/20261024185000_ministry_assignments_source.sql	new	Builder
   scripts/verify/ministry-assignment-census.mjs	new	Builder
   docs/features/crm-ministry-assignments/README.md	new	Builder
   tests/unit/acceptance/issue-1998/ministry-assignments.realstack.acceptance.test.ts	new	Acceptance
   tests/unit/scripts/ministry-assignment-census.test.ts	new	Acceptance
   tests/unit/supabase/ministry-assignments-migration.test.ts	new	Acceptance
   s1 live-name check (no file)	read-only	Builder or Acceptance

   §7 Pins

   • Party FK target: [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570's parties (tenant_id, id). Tombstone: [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606's merged_into_party_id. Legal Entity: [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947's legal_entities (tenant_id, id). If any of these lands with a different shape, stop and escalate to Samson. Don't build substitutes.
   • Guard pattern: [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250 r1 as merged (role, GUC function, ownership transfer, echo).
   • Don't define authz.current_tenant_id (only [Phase 12] #668 slice (f): switch authz.current_tenant_id() to the request tenant; regression set; non-divergence; docs; Closes #668 #2298 may). Don't put is_super_admin() in any policy ([Phase 12] #668 slice (d2): RLS rewrite on spine tables; is_super_admin out of every policy #2296).
   • Don't use the name support_assignments, and don't reference the Support Hub table.

   §8 CI

   No new step and no workflow edit.

   • The migration runs in ci-integration.yml "Apply migrations" (migrate, test-e2e-smoke, test-e2e) through supabase-migrations.mjs, with [Phase 4] #505 slice 4/4: CI gates: RLS catalog assertion + bare service-role client gate #2253's gate when present.
   • In ci.yml:
     • b1 and b2 run in test-unit "Run unit tests";
     • format (bun run format:check), integrity, lint "Run affected lint on pull requests", typecheck "Run affected typecheck on pull requests" and acceptance-tests "Run acceptance tests" run as usual.
   • a1–a8 run in [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250's "Verify tenant isolation (real stack)" (bun x vitest run realstack.acceptance, TENANT_GUARD_IT_ADMIN_DATABASE_URL, fail-not-skip under GITHUB_JOB=migrate). That step isn't on develop yet; [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250 is a prerequisite (§11).

   §9 Data, grants and missionaries.person_id

   • Grants: REVOKE hosted defaults (PUBLIC, anon, authenticated, service_role) on all four tables first. Then grant only tenant_guard the minimal privileges (§2). service_role gets EXECUTE on the six functions only.
   • [Security] missionaries.person_id column-grant fix: anon cross-tenant read + select("*") routes (follow-up from #2256) #2268 check: S1 doesn't create, read or write missionaries.person_id. The census reads missionaries(tenant_id, id, profile_id) only, and memberships reference parties directly. So S1 isn't a "first writer", and no native [Security] missionaries.person_id column-grant fix: anon cross-tenant read + select("*") routes (follow-up from #2256) #2268 block is needed. ([Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606, a prerequisite here, is already natively blocked by [Security] missionaries.person_id column-grant fix: anon cross-tenant read + select("*") routes (follow-up from #2256) #2268.)
   • Phase 12 spine check:
     • S1 consumes no PDP, epoch ([#670 (a)] Governance epoch and governance_version: the per-tenant counter #2287/[Phase 12] Revocation + grant-state: single monotonic tenant epoch + governance_version cache + assignment-bound grant contract + advisory-locked grant-state function + last-admin/last-clearance guards #670), grant ([#670 (b)] Grant table, advisory-locked grant-state function, last-admin and clearance guards, gates #2288) or principal ([Phase 12] Principal foundation: four principal classes + active-assignment primitive + fire-time re-resolution + profiles.role inert-for-authz #669/[Phase 12] #669 slice (c): service-account (NHI) principal: tables, live owner ceiling (preparation only) #2310).
     • S1 doesn't touch authz.*.
     • Its policies are TO tenant_guard guard policies, which [Phase 12] Tenant-axis substrate: tenant-in-the-brand + unified RLS source + delete OR is_super_admin() + positive RLS-isolation gate + kill defaults + cross-tenant-edge invariants #668/[Phase 12] #668 slice (f): switch authz.current_tenant_id() to the request tenant; regression set; non-divergence; docs; Closes #668 #2298 later reconciles.
     • The issue's Phase 12 gate ([Phase 12] Capability spine core: branded Capability + runtime-verifiable EffectiveAccess + one resolver (PDP) + retire the incumbent + names-never-authorize gates + DRT reference model + D22 non-prod isolation #667, [Phase 12] Tenant-axis substrate: tenant-in-the-brand + unified RLS source + delete OR is_super_admin() + positive RLS-isolation gate + kill defaults + cross-tenant-edge invariants #668, [Phase 12] Principal foundation: four principal classes + active-assignment primitive + fire-time re-resolution + profiles.role inert-for-authz #669, [Phase 12] Revocation + grant-state: single monotonic tenant epoch + governance_version cache + assignment-bound grant contract + advisory-locked grant-state function + last-admin/last-clearance guards #670, [Phase 12] Module / entity / field permissions (CRUD, per-field on the Phase-11 catalog, edit-implies-view lattice, manager-rollup opt-in + fail-closed cycle, draft/unpublished, self-scope, merge/dedupe re-derivation) #675, [Phase 12] Classification / security tags / geo-precision / cover-identity alias / protected-constituent floor row / restricted-non-exportable #676, [Phase 12] Purpose/consent axis (resolve with purpose bound to surface + consent AND-floor + contactability) + residency axis (region veto + placement build-invariant + no-default-for-restricted) #680) binds S2 and S3, which expose the path to users. S1 has no user-reachable path.
     • [Phase 12] #668 slice (c): positive tenant-RLS catalog rules, livePolicies baseline, identity exemptions, cross-tenant-edge gate #2294's positive rules: whichever lands second updates (OQ7).
   • Data: no backfill. Existing rows are untouched.

   §10 Size

   • Whole issue as filed: about 1,750 code+docs (migration ~420, API ~500, UI ~600, census ~140, docs ~90) and about 1,500 tests. That's over both caps, so OQ1 proposes a split.
   • S1: migration ~420, census ~140, docs ~70 ≈ ~630. Tests: real stack ~520, unit/static ~200 ≈ ~720. Within caps.

   §11 Dependencies and migration

   • Native today: parent [Phase 9] Epic — Full CRM Depth & Relationship Graph #604; blocked by [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606; blocking AL-2001: Share a new eligible partnership update with its exact audience (P27-C01) #2001, AL-2004: Start or reuse one continuing partnership in context (P27-P01) #2004, AL-2069 — [P28-W01] Enter and switch the exact authorized workspace context #2069.
   • Prerequisites that aren't natively linked: [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570 (Party spine; [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606 builds on it), [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947 (legal_entities), [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250 (tenant_guard and the real-stack step). For S2 and S3 only: [Phase 12] Capability spine core: branded Capability + runtime-verifiable EffectiveAccess + one resolver (PDP) + retire the incumbent + names-never-authorize gates + DRT reference model + D22 non-prod isolation #667/[Phase 12] Tenant-axis substrate: tenant-in-the-brand + unified RLS source + delete OR is_super_admin() + positive RLS-isolation gate + kill defaults + cross-tenant-edge invariants #668/[Phase 12] Principal foundation: four principal classes + active-assignment primitive + fire-time re-resolution + profiles.role inert-for-authz #669/[Phase 12] Revocation + grant-state: single monotonic tenant epoch + governance_version cache + assignment-bound grant contract + advisory-locked grant-state function + last-admin/last-clearance guards #670/[Phase 12] Module / entity / field permissions (CRUD, per-field on the Phase-11 catalog, edit-implies-view lattice, manager-rollup opt-in + fail-closed cycle, draft/unpublished, self-scope, merge/dedupe re-derivation) #675/[Phase 12] Classification / security tags / geo-precision / cover-identity alias / protected-constituent floor row / restricted-non-exportable #676/[Phase 12] Purpose/consent axis (resolve with purpose bound to surface + consent AND-floor + contactability) + residency axis (region veto + placement build-invariant + no-default-for-restricted) #680. I added no links (OQ2).
   • Migration uniqueness: 20261024185000 is provisional.
     • develop: newest is 120000, and there's nothing in 20261024[15-19]*.
     • All 41 refs: only builder/2250-tenant-guard has 150000.
     • Open PRs: feat(identity): normalize identity emails and donor keys (#2254) #2291 (140000/141000); Modernize Sentry, content, email and browser payment SDKs #2214 has no migrations.
     • Reserved list: not in it.
     • 146 issues updated since Oct 20 (bodies and comments): no hits in 20261024164000–169999. In 18xxxx, the only hits are [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606's 180000/181500 (also cited in [Phase 9] #606 slice a/3: parties lifecycle_status, tags, same-kind merge tombstone; spine verification; seed regeneration #2278, [Phase 9] #606 slice b/3: drop donors.type, organization, spouse; replace donors_assign_party; census v5; minimal excision #2279 and [Phase 9] #606 slice c/3 (deferred): drop donors.missionary_id, donors.notes, donor_activities after #608/#616/#617 #2280). 185000 appears nowhere.
     • It sorts after [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606's 181500 and [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570's 170500/171500, and before reserved 190000.
     • [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947 has no version yet. If it lands later than 185000, or develop moves past 185000 before the build, the Builder re-picks a free version newer than every prerequisite and re-runs this check (OQ8).

   §12 OQs (defaults in bold)

   1. Split. Default: AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998 = S1 (this spec). Scope files S2 (API + PDP) and S3 (UI + a11y) as follow-ups after Samson approves, each blocked by S1 and the Phase 12 components. Alternative: keep one issue over the caps.
   2. Native links. Default: Samson adds "blocked by [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570, [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947, [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250" to AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998. Scope adds nothing until told.
   3. btree_gist. Default: enable it in extensions and use EXCLUDE. That's race-proof without app locking. Alternative: an advisory-lock-per-key trigger, which is weaker and harder to prove.
   4. Participant kind. Default: person Parties only (ADR-0136: every spouse or teammate keeps a separate Party). Alternative: allow org.
   5. Past intervals. Default: add/end are prospective only; correct may change past intervals with a required reason.
   6. Retired assignments. Default: refuse new adds; allow end and correct.
   7. [Phase 12] #668 slice (c): positive tenant-RLS catalog rules, livePolicies baseline, identity exemptions, cross-tenant-edge gate #2294 ordering. Default: if [Phase 12] #668 slice (c): positive tenant-RLS catalog rules, livePolicies baseline, identity exemptions, cross-tenant-edge gate #2294 lands first, S1's guard policies must pass its rules; if S1 lands first, [Phase 12] #668 slice (c): positive tenant-RLS catalog rules, livePolicies baseline, identity exemptions, cross-tenant-edge gate #2294 inventories them.
   8. Version. Default: reserve 20261024185000 provisionally; re-pick at build if any prerequisite sorts later.
   9. Attribution. Default: actor_user_id uuid (auth.users id) until [Phase 12] Principal foundation: four principal classes + active-assignment primitive + fire-time re-resolution + profiles.role inert-for-authz #669 principals exist. S2 maps principal → user.
   10. Containment. Default: S1 ships only after Blake's P0 containment decision on production donors/profiles, with no special handling. S1 adds no anon surface.

   §13 Deploy

   Assume production is behind. Production is missing all 58 develop versions from 20260515025814 to 20261024120000 (25 applied, newest 20260513173938), and the anon P0 on donors/profiles is under Blake's containment decision. Dev is 55 behind, with four 20261001* collisions and an extra 20260519233845. develop's catalog is live nowhere hosted.

   Samson relays to Blake at merge. The factory runs nothing hosted.

   • Before merge: s1's read-only live-name check on the development project. Differences go to Samson.
   • Production preflight (read-only, Blake):
     • P1: schema_migrations holds every develop version on the deploy base below this file's version, newest = the base's newest below it, and nothing unexpected above it. Otherwise stop and go to Samson.
       • That means the 58-version backlog, and then [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250, [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570, [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606 and [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947's migrations, are applied first, in order, as their own earlier deploys. Never re-run the backlog.
     • P2: s1's name check on production. Also check that btree_gist is available, and that parties, legal_entities and the tenant_guard role exist.
   • Apply: the normal in-order deploy. The owner precondition refuses it if any owner lacks bypass.
   • Post-checks:
     • 4 tables forced;
     • anon/authenticated/service_role table privileges = none;
     • PUBLIC cannot EXECUTE the six functions;
     • the census runs and reports unresolved counts only.
   • Rollback: only from the P1/P2 preflight records. Drop the six functions and four tables (they're empty, or hold only rows created after deploy, which are exported first). Leave btree_gist in place. Don't touch other objects, and don't re-run the backlog.
   • Dev: if Blake applies to dev, reconcile the collisions and the extra version first.

   §14 Flags

   • ⚑ AL-2069 — [P28-W01] Enter and switch the exact authorized workspace context #2069 is Ready but natively blocked by AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998, which can't build until [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570, [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606, [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947 and [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250 land. Samson's call.
   • ⚑ The issue body's prerequisite "PR docs(AL-1992): publish Phase 27 specification and implementation handoff #1993 unmerged" is stale: it merged Oct 11.
   • ⚑ The issue body mentions status:blocked, but that label isn't on the issue. I didn't change labels.
   • ⚑ support_assignments already exists as the Support Hub table. That's a naming hazard for Phase 21.
   • PR body: Closes #1998 (if OQ1 is approved) or Part of #1998. Scheduling: Samson's call under the factory routing; labels unchanged.
9. II-ricky-bobby-II commented on Oct 24, 2026

   

   II-ricky-bobby-II

   on Oct 24, 2026

   Contributor

   More actions

   Spec r1 approved (Samson), pending Ready (prep only), all defaults (OQ1–OQ10). OQ1 (split ruling, under Blake's standing grant of Oct 24, 2026 to split any issue into slices of about 1k lines): #1998 keeps S1, the database layer: 4 tables and 6 functions, writes only through #2250's tenant-guard functions, anon, authenticated and service_role revoked, RLS enabled and forced, no #2253 allowlist growth. That's about 630 lines of code and docs plus about 720 of tests, inside the budget. Scope files S2 (API) and S3 (UI) as not-Ready follow-ups. OQ2: add native blocked-by links to #570, #1947 and #2250. It can't build until #570, #606, #1947 and #2250 are on develop. OQ3: btree_gist with EXCLUDE. Adding the extension is a new dependency, so I'll tell Security Watch when the build adds it. OQ4: only person Parties can be members. OQ5: only a correction can backdate, and it needs a reason. OQ6: a retired assignment refuses new members. OQ7: whichever of #2294 and S1 lands second does the update. OQ8: migration 20261024185000 is provisional and reserved, and Builder re-checks it's unique before handback. OQ9: the auth.users id is the actor until Phase 12 principals exist. OQ10: production ordering follows Blake's containment decision and the backlog-first rule.
10. II-ricky-bobby-II

    marked this as blocked by 3 issues on Oct 24, 2026

    • [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570
    • [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947
    • [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250
11. II-ricky-bobby-II

    marked this as blocking on Oct 24, 2026

    • [Phase 9] #1998 slice S2: Ministry Assignment server API through withTenant and the Phase 12 PDP #2315
12. II-ricky-bobby-II commented on Oct 24, 2026

    

    II-ricky-bobby-II

    on Oct 24, 2026

    Contributor

    More actions

    Split recorded (Scope, Oct 24, 2026). Samson approved the split under OQ1 of r1 (#1998 (comment)), using Blake's standing grant of Oct 24, 2026 to split issues into slices of about 1k lines.

    • AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998 = S1, the database layer described in r1: 4 tables, 6 guarded functions, the read-only census and real-stack proof. Migration 20261024185000 is provisional and reserved.
    • S2 = [Phase 9] #1998 slice S2: Ministry Assignment server API through withTenant and the Phase 12 PDP #2315, the server API through withTenant and the Phase 12 PDP. Not Ready. It is blocked by AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998.
    • S3 = [Phase 9] #1998 slice S3: People & access UI for Ministry Assignments and participant memberships #2316, the People & access UI and accessibility. Not Ready. It is blocked by [Phase 9] #1998 slice S2: Ministry Assignment server API through withTenant and the Phase 12 PDP #2315.
    • Both are sub-issues of [Phase 9] Epic — Full CRM Depth & Relationship Graph #604, like AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998.
    • Downstream blocking is unchanged. AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998 still blocks AL-2069 — [P28-W01] Enter and switch the exact authorized workspace context #2069, AL-2004: Start or reuse one continuing partnership in context (P27-P01) #2004 and AL-2001: Share a new eligible partnership update with its exact audience (P27-C01) #2001. Each of those needs the canonical source identity and its current eligibility and participants, which S1 provides. One recommendation: AL-2004: Start or reuse one continuing partnership in context (P27-P01) #2004's staff "start" journey selects a ministry in the UI, so it will probably also need [Phase 9] #1998 slice S2: Ministry Assignment server API through withTenant and the Phase 12 PDP #2315 (S2). That link isn't added; it's Samson's call.

    Labels unchanged; no Ready.
13. II-ricky-bobby-II

    marked this as blocking 5 issues on Oct 25, 2026

    • AL-2079 — [P28-R06] End departed access and apply the original preparation clock #2079
    • AL-2088 — [P28-R15] Show only approved expired-referral history #2088
    • [P28-R16b] #2089 follow-up: Continue command, cycles, intents and recovery (missionary and staff lanes) #2353
    • AL-2092 — [P28-F01] Read exact support facts with honest coverage #2092
    • AL-2093 — [P28-F03] Manage one optional goal with safe delegation and versioned Save #2093
14. II-ricky-bobby-II

    marked this as blocked on Oct 26, 2026

    • [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403
15. II-ricky-bobby-II commented on Oct 26, 2026

    

    II-ricky-bobby-II

    on Oct 26, 2026 – with Cursor

    Contributor

    More actions

    Pins addendum (Scope, Oct 26, 2026, 8:20 AM PT), pending Samson approval:

    1. Migration renumbered: 20261024185000_ministry_assignments_source.sql becomes 20261025124500_ministry_assignments_source.sql. The old version sorts below develop's newest (20261025120000, develop 88eefbd9).
    2. Order: it sorts after every slice it consumes: [Phase 7] #570 slice a/2: party spine tables, party fill for existing donors, donors.party_id, census v4 and docs #2271 20261025124000 and [Phase 7] #570 slice b/2: tenant-guarded party accessors (tenant_guard grants, guarded functions, packages/api/src/party) #2272 20261025124100 ([Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570's parties), [Phase 9] #606 slice a/3: parties lifecycle_status, tags, same-kind merge tombstone; spine verification; seed regeneration #2278 20261025124200 and [Phase 9] #606 slice b/3: drop donors.type, organization, spouse; replace donors_assign_party; census v5; minimal excision #2279 20261025124300 ([Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606's tombstone), and [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403 20261025124400 (#1947a).
    3. Legal Entity pin: the legal_entities (tenant_id, id) FK target now comes from [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403 (#1947a, spec r1 [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403 (comment)). The shape is unchanged.
    4. Native link added: AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998 is blocked by [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403. Read back: blocked by [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606, [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570, [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947, [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250 and [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403. The existing links are unchanged, because the body and the r1 approval (OQ2) name [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570 and [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606 as whole-issue prerequisites.
    5. Downstream: S2 [Phase 9] #1998 slice S2: Ministry Assignment server API through withTenant and the Phase 12 PDP #2315 (20261024212000) and AL-2069 — [P28-W01] Enter and switch the exact authorized workspace context #2069 (20261024215000) must sort after this version and after [#670 (a)] Governance epoch and governance_version: the per-tenant counter #2287's. Each needs its own renumber addendum, which is not posted here.
    6. Version is reserved; Samson may renumber at handback to keep merge order.
16. II-ricky-bobby-II

    marked this as blocked by 2 issues on Oct 26, 2026

    • [Phase 7] #570 slice a/2: party spine tables, party fill for existing donors, donors.party_id, census v4 and docs #2271
    • [Phase 9] #606 slice a/3: parties lifecycle_status, tags, same-kind merge tombstone; spine verification; seed regeneration #2278
17. II-ricky-bobby-II

    unmarked this as blocked by 3 issues on Oct 26, 2026

    • [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570
    • [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606
    • [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947
18. II-ricky-bobby-II commented on Oct 26, 2026

    

    II-ricky-bobby-II

    on Oct 26, 2026 – with Cursor

    Contributor

    More actions

    Pins addendum (Scope, Oct 26, 2026, 8:24 AM PT), approved by Samson under the standing authorization:

    1. Dependencies narrowed: in approval 6390959381 OQ2, "[Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570, [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606, [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947 and [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250" now reads [Phase 7] #570 slice a/2: party spine tables, party fill for existing donors, donors.party_id, census v4 and docs #2271 (from [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570: parties (tenant_id, id)), [Phase 9] #606 slice a/3: parties lifecycle_status, tags, same-kind merge tombstone; spine verification; seed regeneration #2278 (from [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606: merged_into_party_id tombstone), [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403 (from [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947: legal_entities (tenant_id, id)) and [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250 (closed). S1 can't build until [Phase 7] #570 slice a/2: party spine tables, party fill for existing donors, donors.party_id, census v4 and docs #2271, [Phase 9] #606 slice a/3: parties lifecycle_status, tags, same-kind merge tombstone; spine verification; seed regeneration #2278 and [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403 are on develop.
    2. Body wording: the body's "currently [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570, [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606, [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947 and [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250" now reads "currently [Phase 7] #570 slice a/2: party spine tables, party fill for existing donors, donors.party_id, census v4 and docs #2271, [Phase 9] #606 slice a/3: parties lifecycle_status, tags, same-kind merge tombstone; spine verification; seed regeneration #2278, [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403 and [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250". The body itself is not edited.
    3. Native links: they now match item 1. [Phase 7] #570 slice a/2: party spine tables, party fill for existing donors, donors.party_id, census v4 and docs #2271 and [Phase 9] #606 slice a/3: parties lifecycle_status, tags, same-kind merge tombstone; spine verification; seed regeneration #2278 were added, and [Phase 7] Party spine: parties supertype + persons anchor + households + household_members + org subtype + org_contacts + donors.party_id #570, [Phase 9] Extend the party spine: lifecycle_status, tags, merge tombstone; regenerate seeds #606 and [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947 were removed. [Phase 7] Canonical Legal Entity and immutable issuer-profile runtime foundation (Backlog draft) #1947 is the parent of [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403 and is no longer in the dependency list. Read back: blocked by [Phase 4] #505 slice 1/4: withTenant tenant guard (non-owner, non-BYPASSRLS role, fail-closed) #2250, [Phase 7] #570 slice a/2: party spine tables, party fill for existing donors, donors.party_id, census v4 and docs #2271, [Phase 9] #606 slice a/3: parties lifecycle_status, tags, same-kind merge tombstone; spine verification; seed regeneration #2278 and [Phase 7 #1947a] #1947 follow-up: legal_entities root, idempotent one-default setup and exact Tenant+Entity check #2403.
    4. The migration stays 20261025124500 (pins addendum AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998 (comment)). Version is reserved; Samson may renumber at handback to keep merge order.
    5. This is AL-1998: [Phase 9] Manage one stable Ministry Assignment and its separate participant memberships (P27-S01) #1998's 2nd addendum since approval 6390959381. Any further change needs a consolidated revision (r2).