⛔ BLOCKED — the v18 development line is not open.
Blocked-by: #15193, #15196, #15204, #15205, #15206, #15207
Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.
In one sentence. Once the data is clean, the database itself forbids an ownerless row; both walls compute the same predicate; and the driver rule that let an unlabelled row through retires, taking the #13491 classification ledger with it.
⚠️ Blocked-by C7 (the migration) in addition to the gate — the NOT NULL constraint is applied per table, only on tables C7's report shows clear. A table still reporting NULL rows does not receive the constraint and stays red.
Scope. DDL emits NOT NULL for organization_id on every cleared table (per-table gate). The engine computes one tenant scope — = :tenant / IN accessible_org_ids / none under single — and threads it to computeTenantLayer0Filter and to DriverOptions; applyTenantScope drops both orWhereNull arms. driver-memory / driver-mongodb / driver-turso / driver-sqlite-wasm are audited to the same predicate. check-tenant-chokepoint.mjs refuses an IS NULL arm. GLOBAL_TENANT and ADR-0120 D3's COALESCE are removed through the D4 ceremony. platform-object-tenancy.ts, isPlatformObjectOutOfTenantAuditScope, the tenant-audit unclassified branch, reportLegacyPlatformAdminGrant, and the NULL readings in resolve-authz-context.ts / sharing-rule-service.ts / settings-service.ts / meta-write-org-scope.ts / bootstrap-system-capabilities.ts all retire. The id columns C2 left beside the name columns are dropped here. Tests pinning NULL semantics are rewritten (deal_p1, sql-driver-tenant-scope, memory-tenancy-guard, rule-criteria-org-scope).
Acceptance. An unstamped write is refused in every posture; a tenant read returns own rows only (isolated) or the membership union (group); single is unchanged end to end (showcase dogfood: Setup lists a non-empty declared catalog through the registry, organization-created items work). Ablation: re-adding one arm reddens exactly the predicate pin. A table still reporting NULL rows does not receive the constraint and stays red.
Protocol 18. Clause-②: yes — this changes the accept set.
Refs: ADR-0131 D1, D8, D9, D13, D14 · ADR-0105 D2 · ADR-0120 D3/D4/D7 · #2734 · #10103 cause 1 · #13491.
⛔ BLOCKED — the v18 development line is not open.
Blocked-by: #15193, #15196, #15204, #15205, #15206, #15207Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.
In one sentence. Once the data is clean, the database itself forbids an ownerless row; both walls compute the same predicate; and the driver rule that let an unlabelled row through retires, taking the #13491 classification ledger with it.
NOT NULLconstraint is applied per table, only on tables C7's report shows clear. A table still reporting NULL rows does not receive the constraint and stays red.Scope. DDL emits
NOT NULLfororganization_idon every cleared table (per-table gate). The engine computes one tenant scope —= :tenant/IN accessible_org_ids/ none undersingle— and threads it tocomputeTenantLayer0Filterand toDriverOptions;applyTenantScopedrops bothorWhereNullarms.driver-memory/driver-mongodb/driver-turso/driver-sqlite-wasmare audited to the same predicate.check-tenant-chokepoint.mjsrefuses anIS NULLarm.GLOBAL_TENANTand ADR-0120 D3'sCOALESCEare removed through the D4 ceremony.platform-object-tenancy.ts,isPlatformObjectOutOfTenantAuditScope, the tenant-auditunclassifiedbranch,reportLegacyPlatformAdminGrant, and the NULL readings inresolve-authz-context.ts/sharing-rule-service.ts/settings-service.ts/meta-write-org-scope.ts/bootstrap-system-capabilities.tsall retire. The id columns C2 left beside the name columns are dropped here. Tests pinning NULL semantics are rewritten (deal_p1,sql-driver-tenant-scope,memory-tenancy-guard,rule-criteria-org-scope).Acceptance. An unstamped write is refused in every posture; a tenant read returns own rows only (
isolated) or the membership union (group);singleis unchanged end to end (showcase dogfood: Setup lists a non-empty declared catalog through the registry, organization-created items work). Ablation: re-adding one arm reddens exactly the predicate pin. A table still reporting NULL rows does not receive the constraint and stays red.Protocol 18. Clause-②: yes — this changes the accept set.
Refs: ADR-0131 D1, D8, D9, D13, D14 · ADR-0105 D2 · ADR-0120 D3/D4/D7 · #2734 · #10103 cause 1 · #13491.