From 43f1cf7200bdc0d2f7ed6cf9ce7eadceacd30cfa Mon Sep 17 00:00:00 2001 From: os-zhuang Date: Fri, 10 Jul 2026 17:31:51 +0800 Subject: [PATCH] docs(liveness): record the tenancy.strategy/crossTenantAccess removal decision (#2763) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Owner decision: two tenancy modes only (per-tenant DB = environment level; shared DB = org row isolation via enabled+tenantField). No object-level isolation requirement — both dead knobs are slated for removal at the next spec major. Ledger notes + authorHints updated to cite #2763 and point at the real mechanisms. Co-Authored-By: Claude Fable 5 --- .changeset/tenancy-removal-decision-note.md | 13 +++++++++++++ packages/spec/liveness/object.json | 8 ++++---- 2 files changed, 17 insertions(+), 4 deletions(-) create mode 100644 .changeset/tenancy-removal-decision-note.md diff --git a/.changeset/tenancy-removal-decision-note.md b/.changeset/tenancy-removal-decision-note.md new file mode 100644 index 0000000000..59581b144f --- /dev/null +++ b/.changeset/tenancy-removal-decision-note.md @@ -0,0 +1,13 @@ +--- +'@objectstack/spec': patch +--- + +docs(liveness): record the tenancy.strategy / crossTenantAccess removal decision (#2763) + +Owner decision 2026-07-10: the platform has exactly two multi-tenancy +modes — per-tenant database (environment-level, zero object config) and +shared-DB organization row isolation (`tenancy.enabled` + `tenantField`). +Object-level isolation strategy has no requirement, so `strategy` and +`crossTenantAccess` are slated for removal at the next spec major. +Ledger notes + compile-time authorHints now state the decision and point +authors at the two real mechanisms. diff --git a/packages/spec/liveness/object.json b/packages/spec/liveness/object.json index 3baa742e86..4f37ff7f1f 100644 --- a/packages/spec/liveness/object.json +++ b/packages/spec/liveness/object.json @@ -129,9 +129,9 @@ "strategy": { "status": "dead", "evidence": "inert — only tenancy.enabled is read", - "note": "part of the live tenancy block (sql-driver reads enabled+tenantField); verify before touching.", + "note": "REMOVAL DECIDED (#2763, owner 2026-07-10): the platform has exactly two tenancy modes — per-tenant database (environment-level, zero object config) and shared-DB org row isolation (enabled+tenantField). Object-level isolation strategy has no requirement; remove at the next spec major.", "authorWarn": true, - "authorHint": "Only tenancy.enabled + tenantField are read (sql-driver row scoping) — 'shared'/'isolated'/'hybrid' changes nothing. Do not expect per-tenant databases from this knob." + "authorHint": "No requirement — removal decided (#2763). Library-level isolation is an environment/deployment choice; row-level isolation is tenancy.enabled + tenantField. This knob changes nothing." }, "tenantField": { "status": "live", @@ -141,9 +141,9 @@ "crossTenantAccess": { "status": "dead", "evidence": "inert", - "note": "part of the live tenancy block; verify before touching.", + "note": "REMOVAL DECIDED (#2763, owner 2026-07-10): cross-visibility governance lives in sharing/OWD (ADR-0056), externalSharingModel (ADR-0090 D11) and access posture; a blanket boolean has no requirement. Remove at the next spec major.", "authorWarn": true, - "authorHint": "Inert — setting it true does NOT grant (or gate) cross-tenant access. Tenant isolation is enforced solely via tenancy.enabled row scoping." + "authorHint": "No requirement — removal decided (#2763). Setting it true grants nothing; use sharing rules / externalSharingModel for cross-visibility." } } },