docs: accept immutable typed reference design - #411
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| # ADR-0150: Always-On Composite Cross-Entity Verification | ||
|
|
||
| - Status: Proposed | ||
| - Status: Accepted |
There was a problem hiding this comment.
This marks ADR-0150 Accepted and ADR-0156 calls it already shipped, while ADR-0156 also documents that the current directed-reachability planner omits upstream members such as Z in Z -> A. Readers therefore cannot distinguish the implemented gating behavior from the still-unimplemented complete weak-component coverage promised by ADR-0150.
Knowledge Base Used: Temper spec format, codegen, and verification
Prompt To Fix With AI
This is a comment left during a code review.
Path: docs/adrs/0150-composite-cross-entity-verification.md
Line: 3
Comment:
**Accepted status overstates coverage**
This marks ADR-0150 Accepted and ADR-0156 calls it already shipped, while ADR-0156 also documents that the current directed-reachability planner omits upstream members such as `Z` in `Z -> A`. Readers therefore cannot distinguish the implemented gating behavior from the still-unimplemented complete weak-component coverage promised by ADR-0150.
**Knowledge Base Used:** [Temper spec format, codegen, and verification](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/temper-spec.md)
How can I resolve this? If you propose a fix, please make it concise.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
| new or changed reference/identity contract. The audit checks: | ||
|
|
||
| - stored reference shape and target existence; | ||
| - consistency of reconstructed historical values with set-once semantics; |
There was a problem hiding this comment.
The activation audit requires reconstructing historical reference values to verify set-once semantics, but existing data-only creates persist only the latest state in entity_catalog and do not append an event history. For those entities the audit can inspect the current reference but cannot determine whether it was previously reassigned, so the ADR needs to define an enforceable fallback or migration rule.
Prompt To Fix With AI
This is a comment left during a code review.
Path: docs/adrs/0156-immutable-typed-cross-entity-references.md
Line: 318
Comment:
**Historical audit lacks source data**
The activation audit requires reconstructing historical reference values to verify set-once semantics, but existing data-only creates persist only the latest state in `entity_catalog` and do not append an event history. For those entities the audit can inspect the current reference but cannot determine whether it was previously reassigned, so the ADR needs to define an enforceable fallback or migration rule.
How can I resolve this? If you propose a fix, please make it concise.
rita-aga
changed the title
1 participant
Accept the design for immutable typed cross-entity references, reference-equality guards, optional deterministic identity, and activation audits. ADR-0149 and ADR-0150 are accepted decisions; the remaining weak-component coverage gap is stated explicitly.
This PR changes documentation only. The proposed SHA-256 identity requires a compatible CSDL string key. Activation audits use available creation/history events, including the data-only Created event, and block when required history is incomplete. Acceptance does not claim runtime implementation.
Validation
Documentation consistency and precommit review passed. The complete corrected design is undergoing the required current-head panel; full workspace push checks are running. Runtime implementation and deployment remain outside this effort.
Decisions & Tradeoffs
Decision
An incomplete historical audit blocks contract activation.
Came up because latest values alone cannot prove historical set-once semantics. Source verification confirmed that the data-only create path does persist a
Createdevent; data-only status alone is not evidence of missing history.Options: infer history from latest values; introduce a new retroactive baseline policy; report incomplete and retain the old spec.
Chose explicit incomplete-audit rejection because the ADR already promises historical consistency and fail-closed activation; latest values cannot prove prior immutability.
Where: PR #411, docs/adrs/0156-immutable-typed-cross-entity-references.md, Sub-Decision 9.
Review corrections within the accepted design
Decision: Require a compatible string key schema for the already-proposed SHA-256 identity, and assess audit completeness from actual history.
Came up because the first panel found that a 64-character hash cannot satisfy the usual
Edm.Guidkey schema, and the earlier audit wording could wrongly discount data-only creation events.Options: change the proposed identity format; leave the metadata contradiction unresolved; clarify the existing hash contract and history evidence.
Chose the contract clarification because it preserves the proposed identity format and fail-closed audit without adding runtime implementation or a new migration mechanism. The data-only
Createdevent counts as evidence; missing required history still blocks activation. The ADR status uses the template's plain Accepted value; its existing implementation-status paragraph remains explicit.Where: PR #411, ADR-0156 Sub-Decisions 4 and 9;
crates/temper-server/src/state/entity_ops.rs,try_create_data_only_tenant_entity;test-fixtures/specs/model.csdl.xml.Scope constraint: This effort changes documentation only. Review requests for runtime implementation, broader verification redesign, or unrelated improvements do not expand this PR.
Reference identity and deletion coverage
Decision: Scalar references denote the complete routed target ID, and every IOA reference participates in the existing incoming-relation delete policy.
Came up because round two found that matching one composite-key component could disagree with actor identity, and optional CSDL navigation must not be the only source of deletion-check edges.
Options: add composite reference encoding or a new deletion mechanism; require CSDL navigation as a second behavioral source; clarify complete-ID matching and derive existing relation edges from IOA.
Chose complete scalar IDs and IOA-derived edges because those follow the ADR's existing scalar-only and IOA-authoritative decisions. Deletion uses the existing Restrict policy; there is no new deletion policy, transaction mechanism, or runtime implementation in this PR.
Where: PR #411, ADR-0156 Sub-Decision 1; existing default in
crates/temper-server/src/registry/relations.rs.Original contribution retained; merge preparation and corrections by GPT-6 in Codex. Required review: Grok 4.6, Codex gpt-5.6-sol, Fable, and Greptile. Current-head review/proof evidence is being completed.