diff --git a/docs/adr/0038-build-verification-loop.md b/docs/adr/0038-build-verification-loop.md index acafecb025e..892daabd789 100644 --- a/docs/adr/0038-build-verification-loop.md +++ b/docs/adr/0038-build-verification-loop.md @@ -2,7 +2,7 @@ > **πŸ”Ά Cloud-owned β€” superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` β†’ `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** β€” see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md). -**Status**: Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2026-06-11). cloud-owned; implemented: L1 graph lint and L4 `verify_build` self-correction in cloud `service-ai-studio` (`verify/graph-lint.ts`), L3 runtime probes in the framework (`metadata-protocol/src/build-probes.ts`, `RuntimeBuildIssue` contract, post-publish probe report in `protocol.zod.ts`), L5 golden-prompt evals (cloud `eval-golden-prompts.yml` on `ai_eval_cases` / `ai_eval_runs`); pending: L2 renderability contract (dataset compile only today). +**Status**: Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2026-06-11). cloud-owned; implemented: L1 graph lint and L4 `verify_build` self-correction in cloud `service-ai-studio` (`verify/graph-lint.ts`), L3 runtime probes in the framework (`metadata-protocol/src/build-probes.ts`, `RuntimeBuildIssue` contract, post-publish probe report in `protocol.zod.ts`), L5 golden-prompt harness built (cloud `eval-golden-prompts.yml`, `scripts/eval/golden-prompts.mjs` on `ai_eval_cases` / `ai_eval_runs`) but unarmed β€” nightly schedule off since 2026-08-04 and no eval environment (cloud#1119); pending: L2 renderability contract (dataset compile only today), L5 arming. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (drafts as the staging layer β€” this ADR **replaces its human-approval assumption for AI builds** with a machine gate; HITL stays for destructive actions), [ADR-0021](./0021-analytics-dataset-semantic-layer.md) (datasets β€” what most verification probes exercise), ADR-0037 / [framework#1694](https://github.com/objectstack-ai/objectstack/pull/1694) (Live Canvas β€” the *human-visibility* complement to this ADR's *machine-verification*) **Consumers**: `@objectstack/service-analytics` + `@objectstack/objectql` (verification probes), `../cloud/service-ai-studio` (graph lint, `verify_build` tool, self-correction protocol, eval intelligence), `../objectui` (build health card in chat), `ai_eval_cases`/`ai_eval_runs` (existing, currently-unused storage) diff --git a/docs/adr/0046-package-docs-as-metadata.md b/docs/adr/0046-package-docs-as-metadata.md index 8c09814e8a3..f2e71572961 100644 --- a/docs/adr/0046-package-docs-as-metadata.md +++ b/docs/adr/0046-package-docs-as-metadata.md @@ -1,6 +1,6 @@ # ADR-0046: Package documentation as metadata β€” flat `src/docs/*.md` compiled into the manifest -**Status**: Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2026-06-12, revised β€” simplified from the original directory/docSet design). implemented: P1 (`DocSchema`, `os build` collection of flat `src/docs/*.md`, publish lint, kernel `doc`), P2 (console documentation portal and help menu, Studio doc editor), P3a/P3b (`book` spine, `GET /meta/book/:name/tree`, Β§6.7 audience gating in the REST read gate); pending: P3c (Studio drag-edit of `doc.order` / groups, anonymous library via `apps/docs`) and P3d (portal taxonomy, book-level search, Β§5 tags). +**Status**: Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2026-06-12, revised β€” simplified from the original directory/docSet design). implemented: P1 (`DocSchema`, `os build` collection of flat `src/docs/*.md`, publish lint, kernel `doc`), P2 (console documentation portal and help menu, Studio doc editor), P3a/P3b (`book` spine, `GET /meta/book/:name/tree`, Β§6.7 audience gating in the REST read gate); pending: P3c (Studio drag-edit of `doc.order` / groups, anonymous library via `apps/docs`) and P3d (portal taxonomy, book-level search, Β§5 tag-based discovery β€” `DocSchema.tags` exists today only as the book-include operand). Β· **Superseded in part (2026-06-13, ADR-0048)** β€” the bare-name overwrite premise; note at Β§3.2. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0003](./0003-package-as-first-class-citizen.md) (package + versioned releases), [ADR-0016](./0016-studio-package-authoring-and-publish.md) (publish pipeline, `manifest_json` snapshot), [ADR-0025](./0025-plugin-package-distribution.md) (artifact distribution, trust boundary), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (AI as primary author) diff --git a/docs/adr/0052-audit-is-not-the-activity-feed.md b/docs/adr/0052-audit-is-not-the-activity-feed.md index a546fb631b3..e2a5e98ab96 100644 --- a/docs/adr/0052-audit-is-not-the-activity-feed.md +++ b/docs/adr/0052-audit-is-not-the-activity-feed.md @@ -323,13 +323,12 @@ rather than written twice. ships P0a.** - **P0b β€” ownership, no behavior change.** βœ… `sys_attachment` registration moved `plugin-audit` β†’ `service-storage` (both always-on, so it stays available; the - definition stays in `platform-objects`). `sys_notification` is **deferred** β€” - originally because it was mid-migration to an event model (ADR-0030) and moving it - would have collided with that in-flight work. That migration is **retired** - (#16194) and the file this line used to name - (`metadata/.../migrate-sys-notification-to-event.ts`) is deleted, so the collision - reason no longer holds; ⚠️ whether the move now proceeds is a call for this - record's owner, not a consequence of the retirement. Still TODO: + definition stays in `platform-objects`). βœ… `sys_notification` registration moved + `plugin-audit` β†’ `service-messaging` (`messaging-service-plugin.ts` registers + `SysNotification`; `audit-plugin.ts` registers only `sys_audit_log`, `sys_activity`, + `sys_comment`, `sys_comment_reaction`). It had been deferred while a migration to an + event model (ADR-0030) was in flight; that migration was retired (#16194) and the + move then went ahead. Still TODO: make "collaboration/activity is a platform primitive" an explicit capability rather than an audit side-effect; keep it default-available so no UI regresses. - **P1 β€” kill the split-brain + milestone templates (Β§5b.2).** Choose the diff --git a/docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md b/docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md index 6e688670f48..b7deef6a2b8 100644 --- a/docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md +++ b/docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md @@ -2,7 +2,7 @@ > **πŸ”Ά Cloud-owned β€” superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` β†’ `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** β€” see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md). -**Status**: Proposed (2026-06-22) β€” cloud-owned (2026-07-16 audit): the framework spec dependencies shipped (`skill.surface` + `agent.surface` enums, `spec/ai/{skill,agent}.zod.ts`); the runtime two-agent split, shim removal, ask-rename and tenant-agent withdrawal live in cloud `service-ai` / objectui and are not verifiable in this repo. +**Status**: Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2026-06-22). cloud-owned; implemented: framework `skill.surface` (`ask` | `build` | `both`, `packages/spec/src/ai/skill.zod.ts`) and the `agent` metadata type closed to runtime creation (`metadata-plugin.zod.ts`, tenant agents withdrawn); cloud `service-ai` resolves `ask` as canonical with `data_chat` and `metadata_assistant β†’ build` as aliases (`agents/agent-aliases.ts`), the runtime catalog lists platform-owned agents only (`agent-runtime.ts`, Β§2), a build-shaped request on the `ask` surface is declined and redirected to the Builder (Β§1), and objectui binds the agent to the surface. Nothing pending. **Deciders**: ObjectStack Protocol Architects **Supersedes**: [ADR-0040](./0040-unified-assistant-and-agent-binding.md) β€” its core decision (a *single* unified assistant selected by *per-turn intent classification*) is **reversed**. ADR-0040's UX win ("the end user never picks from a roster") is **kept** but re-grounded: the *surface* binds the agent, not a classifier and not a dropdown. Β§3 (custom tenant agents) is withdrawn; Β§4 (tool-scoping) is handed to [ADR-0064](./0064-tool-scoping-to-agent.md). **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (draft β†’ verify β†’ publish), [ADR-0038](./0038-build-verification-loop.md) (verify-fix-reverify discipline carried by skills) diff --git a/docs/adr/0064-tool-scoping-to-agent.md b/docs/adr/0064-tool-scoping-to-agent.md index 857b89ceb5c..ead26b39239 100644 --- a/docs/adr/0064-tool-scoping-to-agent.md +++ b/docs/adr/0064-tool-scoping-to-agent.md @@ -2,7 +2,7 @@ > **πŸ”Ά Cloud-owned β€” superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` β†’ `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** β€” see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md). -**Status**: Proposed (2026-06-22) β€” cloud-owned (2026-07-16 audit): the only framework dependency (`skill.surface`) exists; the tool-resolution scoping, global fall-through removal, and bind-time affinity error live in cloud `service-ai` and are not verifiable in this repo. +**Status**: Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2026-06-22). cloud-owned; implemented in cloud `service-ai` `agent-runtime.ts`: an agent's tools are the union of its surface-compatible skills' tools with the global fall-through removed (Β§1), the registry stays global with `schema_reader` as the `surface:'both'` read-only skill (Β§2), an incompatible skill ↔ agent affinity is a load error (Β§3), no new schema (Β§4). Nothing pending. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0063](./0063-two-kernel-agents-skills-are-the-extension-primitive.md) (two agents bound by surface; skill ↔ agent affinity), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (draft-gated authoring tools) **Resolves**: [ADR-0040 Β§4](./0040-unified-assistant-and-agent-binding.md) ("tools are registry-global; a custom agent can change persona but not constrain capability") β€” the named follow-up contract. diff --git a/docs/adr/0071-dataset-semantic-layer-depth.md b/docs/adr/0071-dataset-semantic-layer-depth.md index b0b8b746bd2..b45b3cad1b6 100644 --- a/docs/adr/0071-dataset-semantic-layer-depth.md +++ b/docs/adr/0071-dataset-semantic-layer-depth.md @@ -1,6 +1,6 @@ # ADR-0071: Dataset semantic-layer depth β€” multi-hop joins -**Status**: Proposed. (Refocused β€” see **Correction** below. The first merged draft also proposed matrix/across pivoting; a code check found that already implemented, so this ADR now covers only the remaining gap: multi-hop joins.) **Multi-hop to-one joins (≀3 hops / 4 objects) have since been implemented & are live β€” header pending formal update.** +**Status**: Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2026-06-24, refocused β€” see **Correction** below; the first merged draft also proposed matrix/across pivoting, which a code check found already implemented, so this record covers only multi-hop joins). implemented: P1 multi-hop to-one joins behind the 3-hop cap (`packages/spec/src/ui/dataset.zod.ts` `include` path validation, `service-analytics` `dataset-compiler.ts` and the ObjectQL / native-SQL strategies) and P2 the Studio include-path editor (`DatasetDefaultInspector.tsx`, `useDatasetFields.ts`). Nothing pending. ## Correction (2026-06-24) diff --git a/docs/adr/0072-reference-scope-and-resolvability.md b/docs/adr/0072-reference-scope-and-resolvability.md index 601adf8670e..1296b8af856 100644 --- a/docs/adr/0072-reference-scope-and-resolvability.md +++ b/docs/adr/0072-reference-scope-and-resolvability.md @@ -1,6 +1,6 @@ # ADR-0072: Reference Scope & Resolvability β€” the authored-expression data-picker model (#1934) -**Status**: Proposed (2026-06-25) +**Status**: Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2026-06-25). implemented: Slice 0/1 (flow scope resolution, the `{x}` picker, scope-aware unknown-reference validation inline and in the Problems panel β€” objectui `FlowReferenceField.tsx`, `flow-node-refs.ts`, `flow-expr-problems.ts`) and Slice 2 object-output drilling (`resolveObjectName` from the producing node's `config.objectName`); pending: Slice 3 lazy reference tree, Slice 4 guided fetch (D4), Slice 5 the D2 resolver on formula / validation / visibility / sharing surfaces, and D6 `outputSchema.objectName`; the Open questions stand. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0032](./0032-unified-expression-layer.md) (one authoring language: CEL), [ADR-0058](./0058-expression-and-predicate-surface.md) (the expression & predicate surface β€” interpret vs compile, fail-policy matrix), [ADR-0036 field conditional rules](https://github.com/objectstack-ai/objectui/blob/main/docs/adr/0036-field-conditional-rules.md) (objectui repo) **Consumers**: `@objectstack/spec` (`FlowNode.outputSchema`), `@objectstack/service-automation`, `@objectstack/formula`; `@object-ui/app-shell` (the metadata-admin authoring surface β€” implementation lives in the objectui repo) diff --git a/docs/adr/0073-automation-execution-identity.md b/docs/adr/0073-automation-execution-identity.md index 9fc3cbe8945..1143a18bb6f 100644 --- a/docs/adr/0073-automation-execution-identity.md +++ b/docs/adr/0073-automation-execution-identity.md @@ -1,6 +1,6 @@ # ADR-0073: Automation execution identity β€” a built-in non-human principal for user-less runs, `runAs` as authorization posture, attribution always concrete -**Status**: Proposed (2026-06-25) +**Status**: Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2026-06-25). implemented as the record scopes v1: the decision record (D1–D4), the D5 author-time guardrail (`packages/lint` `flow-runas-unscoped` on every user-less trigger), and the two amendments above (#3760: a user-less `runAs:'user'` data operation is refused, `UnscopedRunDataAccessError`; #25251: a `runAs:'system'` run writes no identity assignment); pending: M2 β€” the per-environment `automation` principal and `runAs:'automation'` (`execution.zod.ts` still `['system','user']`), gated on the first real consumer, not a date. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0002](./0002-environment-database-isolation.md) (**environment-per-database** isolation; Control-Plane / Data-Plane split), [ADR-0004](./0004-cloud-multi-kernel.md) (`ObjectKernel` per environment), [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-mark gate; stage by whether the feature exists), [ADR-0057](./0057-erp-authorization-core-business-units-and-scope-depth.md) (`sys_role` is platform-native; `ExecutionContext.roles`; scheduled/lifecycle jobs), [ADR-0066](./0066-unified-authorization-model.md) (capability / assignment / requirement separation β€” resources declare a capability, never "who"), [ADR-0068](./0068-unified-user-context-and-built-in-identity-roles.md) (`EvalUser` / `current_user`; **identities are roles, not booleans**) **Consumers**: `@objectstack/spec` (the identity contract + `runAs` semantics), `@objectstack/cli` (author-time validation), `@objectstack/plugin-security` (`resolve-execution-context`, RLS, seeded roles β€” M2), `@objectstack/service-automation` (the engine's `runAs` resolution β€” M2), `@objectstack/trigger-schedule` + `@objectstack/trigger-api` (user-less trigger surfaces), `@objectstack/plugin-reports` (the report scheduler β€” today hand-rolls `SYSTEM_CTX`), `@objectstack/runtime` (audit actor), and the ADR-0057 lifecycle/retention jobs. diff --git a/docs/adr/README.md b/docs/adr/README.md index e4065f06f6c..c54fac3165a 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -17,8 +17,8 @@ | Status | Records | |---|---| -| Accepted | 116 | -| Proposed | 14 | +| Accepted | 121 | +| Proposed | 9 | | Superseded | 4 | | Draft | 3 | | Deferred | 2 | @@ -134,17 +134,17 @@ A bare `ADR-0006` names the decision; its current text is [0006-project-environm | [ADR-0060](./0060-conformance-ledger-platform-pattern.md) | Conformance Ledger as a Platform Pattern | Accepted β€” P1–P2 implemented; D5 landed-bar in force; D6 (CI aggregate) de… | 2026-06-21 | β€” | β€” | | [ADR-0061](./0061-record-search-architecture.md) | Record Search Architecture β€” metadata-driven `$search` resolution | Accepted β€” 2026-06-21; Tier 1 β€” implemented and conformance-closed per thi… | 2026-06-21 | β€” | β€” | | [ADR-0062](./0062-external-datasource-runtime.md) | External Datasource Runtime β€” connection lifecycle, credentials, visibility & query completeness | Accepted β€” 2026-06-22 β€” D1–D8 implemented. D1 fully implemented across bot… | 2026-06-22 | ADR-0015 | β€” | -| [ADR-0063](./0063-two-kernel-agents-skills-are-the-extension-primitive.md) | Two agents (`ask` / `build`), bound by surface; skills are the only third-party extension primitive | Proposed β€” 2026-06-22 β€” cloud-owned (2026-07-16 audit): the framework spec… | 2026-06-22 | ADR-0040, ADR-0064 | cloud ADR-0025 | -| [ADR-0064](./0064-tool-scoping-to-agent.md) | Tool scoping β€” an agent's tools are exactly its skills' tools | Proposed β€” 2026-06-22 β€” cloud-owned (2026-07-16 audit): the only framework… | 2026-06-22 | β€” | cloud ADR-0025 | +| [ADR-0063](./0063-two-kernel-agents-skills-are-the-extension-primitive.md) | Two agents (`ask` / `build`), bound by surface; skills are the only third-party extension primitive | Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2… | 2026-10-28 | ADR-0040, ADR-0064 | cloud ADR-0025 | +| [ADR-0064](./0064-tool-scoping-to-agent.md) | Tool scoping β€” an agent's tools are exactly its skills' tools | Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2… | 2026-10-28 | β€” | cloud ADR-0025 | | [ADR-0065](./0065-sdui-styling-model.md) | SDUI styling model β€” scoped style-objects over arbitrary Tailwind classes | Accepted β€” 2026-06-22 β€” open-mechanism half implemented: `style`/`responsi… | 2026-06-22 | β€” | β€” | | [ADR-0066](./0066-unified-authorization-model.md) | Unified authorization model β€” capability registry, secure-by-default posture, resourceβ†’capability contracts,… | Accepted β€” 2026-06-23 β€” D1–D5 + refinements β‘€/⑨ implemented (capability re… | 2026-06-23 | β€” | β€” | | [ADR-0067](./0067-commit-history-and-rollback-for-ai-authoring.md) | Commit history and rollback for AI authoring β€” turns become atomic, revertible commits | Accepted β€” 2026-06-24; completed 2026-07-16 Β· Amended (2026-08-06, #5351/#… | 2026-06-24 | β€” | β€” | | [ADR-0068](./0068-unified-user-context-and-built-in-identity-roles.md) | Unified user-context contract & built-in identity roles β€” one `currentuser` shape across formula/RLS/client,… | Accepted β€” 2026-06-24 β€” implemented under the position model: `EvalUser` f… | 2026-06-24 | β€” | β€” | | [ADR-0069](./0069-enterprise-authentication-hardening.md) | Enterprise authentication hardening β€” password policy, enforced MFA, SSO, session controls, network gating, a… | Accepted β€” P1 + P2 implemented (2026-07-04); P3 partially landed (see Adde… | 2026-07-04 | β€” | β€” | | [ADR-0070](./0070-package-first-authoring.md) | Package-first authoring β€” every runtime-authored item lives in a writable package (base); no orphans | Accepted β€” 2026-06-24 β€” P1–P3 implemented, merged & live-verified (see Imp… | 2026-06-24 | β€” | β€” | -| [ADR-0071](./0071-dataset-semantic-layer-depth.md) | Dataset semantic-layer depth β€” multi-hop joins | Proposed β€” Refocused β€” see Correction below. The first merged draft also p… | β€” | β€” | β€” | -| [ADR-0072](./0072-reference-scope-and-resolvability.md) | Reference Scope & Resolvability β€” the authored-expression data-picker model (#1934) | Proposed β€” 2026-06-25 | 2026-06-25 | β€” | β€” | -| [ADR-0073](./0073-automation-execution-identity.md) | Automation execution identity β€” a built-in non-human principal for user-less runs, `runAs` as authorization p… | Proposed β€” 2026-06-25 | 2026-06-25 | β€” | β€” | +| [ADR-0071](./0071-dataset-semantic-layer-depth.md) | Dataset semantic-layer depth β€” multi-hop joins | Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2… | 2026-10-28 | β€” | β€” | +| [ADR-0072](./0072-reference-scope-and-resolvability.md) | Reference Scope & Resolvability β€” the authored-expression data-picker model (#1934) | Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2… | 2026-10-28 | β€” | β€” | +| [ADR-0073](./0073-automation-execution-identity.md) | Automation execution identity β€” a built-in non-human principal for user-less runs, `runAs` as authorization p… | Accepted β€” 2026-10-28 (ruled on objectstack#26553, ADR batch 3; proposed 2… | 2026-10-28 | β€” | β€” | | [ADR-0074](./0074-canonical-audit-timestamp-storage-on-sqlite.md) | Audit timestamps are stored in one canonical, timezone-explicit format on SQLite | Accepted β€” 2026-06-26. Read side extended (2026-09-07): the read repair th… | 2026-06-26 | β€” | β€” | | [ADR-0076](./0076-objectql-core-tiering.md) | objectql is the data engine β€” relocate metadata management (protocol) out of it; enforce the boundary; defer… | Accepted β€” D1/D2/D4/D5/D6/D8/D9 implemented; D10/D12 partially landed; D11… | 2026-08-15 | β€” | β€” | | [ADR-0077](./0077-authoring-surface-boundary-hook-flow-validation.md) | The authoring-surface boundary β€” route by intent, not mechanism; verifiability tier = friction tier; loud-not… | Proposed β€” 2026-06-28 | 2026-06-28 | β€” | β€” |