docs(adr): propose ADR-0114 — layered master data: group template rows and organization overrides (ADR-0105 D10)

[os-zhuang]

The follow-up ADR that ADR-0105 D10 reserves ("Mechanics … to be detailed in a follow-up ADR; this ADR reserves the concept and its place in Phase 2"). Tracking: #4030 (split from #3541 at close-out). Docs-only, empty changeset — nothing ships before this is Accepted.

What it proposes

The SAP material-master / 用友-金蝶 集团统管 shape, as spec + engine mechanics:

• D1 — Declaration: strict masterData.layered block — overridableFields + distribution: centralized | tiered (自由 = absence of the block, honoring ADR-0078: no inert spelling).
• D2 — Model: one object, row-shadowing. Template rows marked is_master_template, owned by the publishing org; override rows link via master_template_id, owned by the consuming org, and may physically carry only overridable fields — group governance enforced at write time (refusal, not dropping), one override per (template, org) via the 多租户缺陷:unique 物化为全局唯一索引、无视 tenancy,与按租户分裂的 autonumber 序列自相矛盾(跨租户必然撞号 + 存在性探测泄露) #3696 per-tenant unique machinery.
• D3 — Reach: ancestor-published template rows are readable through the tenant wall — the platform's first deliberate exception to the ADR-0105 D2 union predicate. Bounds: read-only (write filter unchanged), Layer-0-owned (W1/W2 hold unchanged), fail-closed (empty ancestor set ⇒ plain wall), not the PLATFORM_ADMIN rung. Computed in resolveAuthzContext as template_org_ids (ancestor closure via the D9 walk), consumed by computeTenantLayer0Filter as a new optional input.
• D4 — Resolution: raw reads stay byte-identical; explicit resolve: 'effective' merges field-wise; references key on the template row id (override rows are attribute shadows, not addressable entities — the SAP MARA/MARC lesson).
• D5 — Posture/entitlement: group only; boot refusal in single/isolated (ADR-0093 D5 doctrine, D9 precedent); entitlement rides ADR-0105 D12 unchanged — all enforcement open-core (强制免费), cloud sells distribution management (治理收费, cloud#874).
• D6 — The D6 red-line amendment: ADR-0105 D6 red line ① ("no permission inheritance along the org axis") is amended with the data-vs-capability distinction — template reach is marked-row data flow, never grants/write/admin — rather than being carved through silently.
• D7/D8 — Lints, conformance, adoption: validateOrgAxisRedLines extensions, authz-matrix-gate pinning, dogfood rows beside cloud#919, loud adoption (os migrate master-data --link-by) instead of silent reinterpretation of existing rows.

Alternatives it rejects (with reasoning in the text)

Platform-global objects (no wall, no overrides) · copy-on-distribute (the serious one — needs no wall exception, but surrenders engine-enforced field governance, which is the feature) · cross-org sharing rules (breaches D6 red line ②, would widen the just-hardened ADR-0111 surface) · two-object MARA/MARC split (stays available as an app pattern) · a crossTenantAccess-style config flag (the exact ADR-0049 class the v15 cleanup removed — the tombstone in data/object.zod.ts is cited).

Honest costs recorded

Layer 0's pure function gains its first OR branch; resolveAuthzContext adds a per-request ancestor walk on a resolver #3541's evaluation already flagged as uncached — the ADR states a resolver-caching decision is worth its own issue before Phase B lands at scale.

Review focus

This is a founder-decision document: D3 (the wall exception exists at all), D2's write-time governance vs copy-on-distribute, and D4's template-id-as-entity are the three rulings everything else hangs off.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HY3STSsNLWuivhj1L81a5S

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 30, 2026 5:25am

[os-zhuang]

Withdrawn per founder ruling: 不要想象需求，放大项目 — no concrete customer demand exists for cross-wall master data (verified: zero filed issues in framework or cloud; every shipped cross-org capability deliberately works through membership union, and D9 explicitly chose dropping non-members over crossing the wall). Design work on D10 does not restart until a named real-world scenario exists. The concept reservation stays where it already lives — ADR-0105 D10 — and needs no proposal ahead of demand. ADR number 0114 is released.

---

Generated by Claude Code