Skip to content

docs(gap-baseline): record enterprise org-hierarchy ABAC contract decision #1680

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
seonghobae wants to merge 3 commits into
base: main
Choose a base branch
from
+52 −0
Open

docs(gap-baseline): record enterprise org-hierarchy ABAC contract decision #1680

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b554165
docs(gap-baseline): record enterprise org-hierarchy ABAC contract dec…
claude Sep 2, 2026
10163dd
Merge remote-tracking branch 'origin/main' into claude/enterprise-org…
seonghobae Sep 2, 2026
96fa7ca
Merge remote-tracking branch 'origin/main' into claude/enterprise-org…
seonghobae Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 52 additions & 0 deletions docs/product-technical-gap-baseline.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2649,6 +2649,58 @@ Higgins, S. S., Crepalde, N., & Fernandes, L. (2021). Segmented multiplexity: A

**Follow-up.** If the organization later solves free+ZDR routing robustly enough to deliberately widen required-review CI to `orchestrator/auto` (e.g. once a spend ceiling and reviewer-visible cost evidence exist for that path), the change is exactly one `case` arm plus the corresponding assertions in `test_sidecar_pins_the_pool_to_free_for_github_actions` — this entry is the record of *why* it was narrowed, not a permanent prohibition.

## 2026-09-02 enterprise org-hierarchy / concurrent-membership ABAC contract: design decision recorded

**Requirement.** ContextualWisdomLab products need a general way to represent an enterprise
customer's organizational hierarchy (지주(holding) → 계열사(affiliate) → 사업부문(division) →
사업부(unit) → 파트(part) → 팀(team)) where team/part ordering can invert per tenant, and where a
person can hold *concurrent* membership in more than one unit (TFT / dual-hat assignments), for
ABAC/RBAC permission scoping (Keyverse backlog items 20/22: Keyverse becoming a service ABAC/RBAC
engine) and for any product that needs "which org unit does this user/resource belong to."

**Re-verified before deciding.** `docs/product-goal-directive.md` §9 does not name
`enterprise-architecture-core` or `context-graph-contracts`; both repositories nonetheless exist
(created 2026-08-16, active) and neither has any open PR or issue touching org-hierarchy, org-unit,
tenant, or ABAC/RBAC as of this entry — confirmed by re-reading every open PR/issue title in both
repos directly via the GitHub API, not by trusting an earlier pass. Keyverse's `README.md` explicitly
disclaims org-tree ownership ("Keyverse does not copy Orgmetra tables"). Keyverse draft PR
`ContextualWisdomLab/keyverse#103` (`feat(authorization): hierarchical PDP...`, still draft,
`mergeable_state: dirty`) hardcodes a single, position-checked 5-level `ORG_PATH_LEVELS` taxonomy with
no per-tenant reordering and one `org_path` per `AssignmentSnapshot` (no concurrent-membership
primitive) — verified by reading `org_authorization.py` directly. `Orgmetra`'s `packages/hris-kernel`
already models a generic, variable-depth, bitemporal, cycle-checked org tree
(`OrganizationUnitVersion.parent_organization_unit_id`) and already allows concurrent multi-assignment
per person (`AssignmentFact.allocation_ratio`, portfolio sum ≤ 1.0000 FTE) — verified by reading
`facts.py`, `employment.py`, `assignment.py`, `organization.py`, and `docs/DATA_MODEL.md` directly.

**Decision.** Hybrid ownership, not a new repository: the org-unit tree and the underlying
person→position→unit assignment facts stay in **Orgmetra** (already correctly shaped, not
duplicated); the cross-product interoperability *contract* for reading a membership fact (primary or
secondary/TFT, with its own effective-date range) is registered in **`context-graph-contracts`**,
reusing its existing `ContextAssertion`/`ContextMembership` pair (ADR-0006) with a new
`org_member_primary` / `org_member_secondary` predicate vocabulary — **no schema files change**;
Comment on lines +2678 to +2681

@devin-ai-integration devin-ai-integration Bot Sep 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Unmerged foundation dependency

ContextAssertion, ContextMembership, and ADR-0006 exist only in another open pull request. Merging the linked decision first leaves its accepted contract without schemas.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

**Keyverse** remains the ABAC/RBAC PDP implementer, extending its own draft PR #103 as a later,

@devin-ai-integration devin-ai-integration Bot Sep 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Unlinked cross-repository references

Bare #103 and keyverse#103 references do not link to Keyverse. They violate the repository’s mandatory cross-repository traceability convention.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

separately-reviewed follow-up. `enterprise-architecture-core` was considered and rejected for this
piece specifically: its in-flight work is architecture-governance process tooling (target-state
transformation, fitness baselines, CSAP/SOC2 evidence), not a data-interchange schema, and
`context-graph-contracts`'s stated purpose and existing artifact shapes are the closer structural
match. Full reasoning, the wire-shape design, an ABAC evaluation-query sketch (ancestor closure
embedded in each membership assertion, so a "member of X or any descendant of X" policy check needs no
tree traversal at decision time), and a precise reconciliation with keyverse#103 (which parts are
compatible vs. specifically incompatible, and why) are recorded in
[`context-graph-contracts` ADR 0001](https://github.com/ContextualWisdomLab/context-graph-contracts/pull/23)
(`docs/adr/0001-enterprise-org-hierarchy-membership-contract.md`, PR #23).

**Scope of this pass.** ADR only — no schema, fixture, or code changes in `context-graph-contracts`;
`keyverse#103` is not modified. Deferred to separately-reviewed follow-up PRs: an explicit,
non-heuristic primary/secondary field on Orgmetra's `assignment_record` (Orgmetra's own ADR process);
the closure/materialized-path emitter; extending `org_authorization.py` per the reconciliation record
(depth-only `parse_org_path`, `AssignmentSnapshot.memberships: list[...]`, dropping `"person"` as a
tree leaf level); wiring naruon's fixed two-level `Organization`/`OrganizationGroup` tenant model to
this contract; and conformance fixtures/tests for the two registered predicates.

**Update (2026-09-02, later the same day): `context-graph-contracts#23` (ADR 0001, cited above) was closed, not merged**, by a concurrent review during this same investigation window — its closing comment cites unresolved executable-contract defects (wire interpretation, bitemporal/replay semantics, primary-membership cardinality, reproducibility) and an ADR-numbering collision with that repository's separate `chatgpt/*` PR stack; see this document's SCIM/OIDC/SAML exchange-design entry for the closer's full reasoning. This does not invalidate the hybrid-ownership decision or the keyverse#103 reconciliation recorded here — both came from directly reading Orgmetra's and Keyverse's own code, not from PR #23's now-superseded schema draft — but the ADR-0001 wire-shape details specifically must be re-validated once the org-membership contract is rebuilt on whichever PR the `chatgpt/*` stack lands as. Flagging this rather than letting a closed upstream PR read as a landed dependency is the point of this note.

## 2026-09-02 org-queue-sweep investigation: historical conclusion superseded by PR #1821

**Current status (2026-09-04).** The conclusion below was invalidated by live queue evidence. PR #1821 removed the organization-wide Actions-run inventory and cancellation block from `org-queue-sweep` and merged as `11bb6a7871f4d95ab8a3eab616b4264d02327010`. Native per-PR concurrency and the current-head coalescer now own stale-run cancellation; the scheduled sweep retains only missed review, merge, and branch-update recovery. Focused ownership contracts passed 78 tests before merge. This preserves the event-gap recovery described below without paying the repository-wide run-listing and cancellation API cost.
Expand Down
Loading