Two-kind adapter model driven by authorization reachabilityrecord 1
{
"id": "P09-I-001",
"source_ids": [
"P09-I-C-1",
"P09-I-C-4"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Two-kind adapter model driven by authorization reachability",
"claim": "Classify every donor store on one axis: can the host reach its authorization layer? Yes gets in-database RLS; no gets host-proxy-enforced shapes where client subsets may only narrow, never widen. Two adapter kinds, not N per donor.",
"precedent": "ElectricSQL explicitly refuses to codify auth into a database rule system and enforces shape in a proxy; Algolia signs a filter into a credential handed to an untrusted client",
"limitations": "Proxy enforcement adds a hop and a failure mode; unmeasured latency cost",
"rank": 1,
"disposition": "top10"
}
Tenant context as a typed wrapper that cannot emit an unscoped queryrecord 2
{
"id": "P09-I-002",
"source_ids": [
"P09-I-R-1"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Tenant context as a typed wrapper that cannot emit an unscoped query",
"claim": "Build the missing multi-tenancy library in the type system, since none exists for a TypeScript host: a query builder where omitting the tenant predicate is a compile error rather than a review finding.",
"precedent": "No adoptable OSS exists; archtechx/tenancy (Laravel) and django-multitenant are design references only",
"limitations": "Type-level guarantees do not cover raw SQL escape hatches or donor-native queries",
"rank": 2,
"disposition": "top10"
}
Licence-body CI gate reading LICENSE text, not API SPDX fieldsrecord 3
{
"id": "P09-I-003",
"source_ids": [
"P09-I-C-7",
"P09-I-R-11"
],
"evidence_class": "observed",
"observed": "2026-08-27",
"title": "Licence-body CI gate reading LICENSE text, not API SPDX fields",
"claim": "Fail the build on FSL/BSL/SSPL/ELv2/AGPL entering the dependency tree, reading the licence body rather than the badge. This run produced 12+ corrections; five surfaces would have passed an automated SPDX scan silently.",
"precedent": "Citus AGPL, Liquibase FSL reported as Other, Redpanda null to the API with terms at licenses/bsl.md, Meilisearch MIT AND BUSL, MinIO AGPL and archived, SuperTokens NOASSERTION with a paid ee/ carve-out",
"limitations": "Does not cover transitive dependency licences, which were not verified for any repo this run",
"rank": 3,
"disposition": "top10"
}
Shape contract as the donor read agreementrecord 4
{
"id": "P09-I-004",
"source_ids": [
"P09-I-C-12"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Shape contract as the donor read agreement",
"claim": "Give every donor system a versioned, reviewable declaration of the tables, columns and WHERE clause the host may read. It becomes the audit artifact for what the host actually consumes from an absorbed app.",
"precedent": "Electric shapes; SISOCRM's explicit cross-schema read boundary",
"limitations": "Requires donor schema stability; a donor upgrade can invalidate the contract silently without P09-I-005",
"rank": 4,
"disposition": "top10"
}
Continuous drift detection against donor-owned storesrecord 5
{
"id": "P09-I-005",
"source_ids": [
"P09-I-R-2",
"P09-I-R-13"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Continuous drift detection against donor-owned stores",
"claim": "Run schema diffing continuously against donor stores so 'the donor changed its schema under us' becomes a monitored, alertable event rather than a production outage.",
"precedent": "Atlas is the only surveyed tool answering whether a donor store still matches our contract",
"limitations": "Atlas OSS feature boundary is at the vendor's discretion; confirm drift detection is in the OSS binary before committing",
"rank": 5,
"disposition": "top10"
}
Transactional outbox as the federation event substraterecord 6
{
"id": "P09-I-006",
"source_ids": [
"P09-I-R-3"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Transactional outbox as the federation event substrate",
"claim": "Enqueue the event in the same transaction as the state change, eliminating the enqueue-vs-commit race across every federation boundary. Pairs with a consumer-side idempotency gate for effectively-once.",
"precedent": "pg-boss enqueues in-transaction; the outbox pattern is mature",
"limitations": "Postgres-backed queue throughput ceilings at expected action volume are unknown",
"rank": 6,
"disposition": "top10"
}
Cost-at-rest as the tenancy selection rulerecord 7
{
"id": "P09-I-007",
"source_ids": [
"P09-I-C-5"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Cost-at-rest as the tenancy selection rule",
"claim": "Place low-activity tenants on a scale-to-zero substrate and promote to shared-RLS only when activity justifies always-on compute. The dividing line between tenancy models is cost at rest, not capability.",
"precedent": "Every surface can do database-per-tenant; only D1, Durable Objects, Neon and Turso afford it at high counts. Supabase Pro does not scale to zero, which is why its guidance is RLS-first.",
"limitations": "Promotion between models is a migration, not a config flag; the cost of that transition is unmeasured",
"rank": 7,
"disposition": "top10"
}
Owned versus federated state distinguished in the type systemrecord 8
{
"id": "P09-I-008",
"source_ids": [
"P09-I-C-11"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Owned versus federated state distinguished in the type system",
"claim": "Make a query that joins across the ownership boundary fail at compile time rather than silently read a donor's stale replica.",
"precedent": "First-principles; no surveyed product does this",
"limitations": "Cannot prevent the same mistake inside donor-native code",
"rank": 8,
"disposition": "top10"
}
Shadow-read verification to quantify federation driftrecord 9
{
"id": "P09-I-009",
"source_ids": [
"P09-I-R-14"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Shadow-read verification to quantify federation drift",
"claim": "Serve from Actionist state while comparing against the donor's native store, measuring divergence before the read model is trusted for a client-visible workflow.",
"precedent": "Standard migration practice, unapplied here",
"limitations": "Doubles read cost during the verification window",
"rank": 9,
"disposition": "top10"
}
Exit plan required wherever a vendor owns the state machinerecord 10
{
"id": "P09-I-010",
"source_ids": [
"P09-I-C-18"
],
"evidence_class": "observed",
"observed": "2026-08-27",
"title": "Exit plan required wherever a vendor owns the state machine",
"claim": "Sync and workflow are the classes where the vendor owns your state machine rather than your bytes. Any adoption there requires a documented exit path on day one.",
"precedent": "Fauna is the receipt: 3,000+ teams, permanent data deletion, roughly two months' notice",
"limitations": "An exit plan is not an exit; it is unrehearsed until executed",
"rank": 10,
"disposition": "top10"
}
Narrowing-only filter compositionrecord 11
{
"id": "P09-I-011",
"source_ids": [
"P09-I-C-3"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Narrowing-only filter composition",
"claim": "Client filters are AND-ed with the host filter, never OR-ed, eliminating a whole class of cross-tenant widening bugs.",
"precedent": "Electric client subsets may only narrow",
"limitations": "Cheap and correct; ranked below only because it is a property of P09-I-001 rather than a standalone mechanism",
"rank": 11,
"disposition": "register"
}
Host-issued tenant-scoped capability token as the federation primitiverecord 12
{
"id": "P09-I-012",
"source_ids": [
"P09-I-C-2"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Host-issued tenant-scoped capability token as the federation primitive",
"claim": "One signed, unalterable, filter-bearing credential every donor adapter must honour.",
"precedent": "Algolia secured API keys",
"limitations": "Requires every donor adapter to validate it, which intact services may not support",
"rank": 12,
"disposition": "register"
}
Per-tenant coordination actorrecord 13
{
"id": "P09-I-013",
"source_ids": [
"P09-I-C-6"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Per-tenant coordination actor",
"claim": "One single-threaded actor per tenant for locks, sequencing and in-flight donor sync state, avoiding a distributed lock service entirely.",
"precedent": "Durable Objects give a serialization point without external locking",
"limitations": "Couples the coordination model to an edge substrate unless reimplemented",
"rank": 13,
"disposition": "register"
}
RLS as the single authorization source binding every access pathrecord 14
{
"id": "P09-I-014",
"source_ids": [
"P09-I-R-4"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "RLS as the single authorization source binding every access path",
"claim": "Host service and any API layer are both subject to the same policies, so isolation cannot be bypassed by adding a service.",
"precedent": "PostgREST plus RLS; removes the LLM-authored-RLS class by making policies platform-owned",
"limitations": "Only reaches stores whose authorization layer the host controls",
"rank": 14,
"disposition": "register"
}
Licence carve-outs encoded as testable policy rulesrecord 15
{
"id": "P09-I-015",
"source_ids": [
"P09-I-C-8"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Licence carve-outs encoded as testable policy rules",
"claim": "Redpanda's 'third parties cause topic creation' and Elastic's 'x-pack only' are testable conditions against a planned architecture, not prose to remember.",
"precedent": "Both carve-outs read this run",
"limitations": "Requires legal review to confirm the encoding is faithful",
"rank": 15,
"disposition": "register"
}
One retrieval plane rather than separate search and vector planesrecord 16
{
"id": "P09-I-016",
"source_ids": [
"P09-I-C-10"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "One retrieval plane rather than separate search and vector planes",
"claim": "Search and vector have converged commercially; build one plane with a tenancy filter, chosen for licence safety.",
"precedent": "Typesense markets against Algolia and Pinecone; Atlas and Elastic carry both",
"limitations": "Pilot retrieval quality may demand a dedicated engine",
"rank": 16,
"disposition": "register"
}
Meter tenants on the dimension the substrate metersrecord 17
{
"id": "P09-I-017",
"source_ids": [
"P09-I-C-13",
"P09-I-C-16"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Meter tenants on the dimension the substrate meters",
"claim": "Price on rows read/written where the substrate does, so host pricing cannot invert against supplier cost; budget egress as a federation tax since bridging N donors multiplies data movement.",
"precedent": "Turso meters rows; zero-egress storage is an architectural choice",
"limitations": "Commercial rather than architectural, so it belongs to P15 as much as P09",
"rank": 17,
"disposition": "register"
}
Deliberate per-tenant storage ceilingrecord 18
{
"id": "P09-I-018",
"source_ids": [
"P09-I-C-17"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Deliberate per-tenant storage ceiling",
"claim": "Set a hard ceiling so sharding is an early design decision rather than a late migration.",
"precedent": "D1 10 GB, Liveblocks 10 MB per room",
"limitations": "A ceiling that is too low becomes a product limitation",
"rank": 18,
"disposition": "register"
}
Conflict strategy chosen per data classrecord 19
{
"id": "P09-I-019",
"source_ids": [
"P09-I-C-14"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Conflict strategy chosen per data class",
"claim": "Last-write-wins only where truthful; server-authoritative mutations or CRDTs where edits genuinely conflict.",
"precedent": "Electric's LWW is uncustomizable; Zero and y-sweet offer the alternatives",
"limitations": "Requires classifying every synced data class",
"rank": 19,
"disposition": "register"
}
Per-tenant embedded databases for hot runtime staterecord 20
{
"id": "P09-I-020",
"source_ids": [
"P09-I-R-6"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Per-tenant embedded databases for hot runtime state",
"claim": "libSQL per tenant for hot state with Postgres as durable registry: database-per-tenant without a schema explosion.",
"precedent": "Turso prices unlimited databases",
"limitations": "Two substrates to operate; consistency between them is the new problem",
"rank": 20,
"disposition": "register"
}
Retention enforced by the database, not a cron scriptrecord 21
{
"id": "P09-I-021",
"source_ids": [
"P09-I-R-9"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Retention enforced by the database, not a cron script",
"claim": "Partition-managed audit retention with the policy encoded as tenant configuration, so retention promises are structurally enforced.",
"precedent": "pg_partman, PostgreSQL-licensed",
"limitations": "Retention promises are also a legal artifact; encoding is necessary, not sufficient",
"rank": 21,
"disposition": "register"
}
Durable workflow per capability installrecord 22
{
"id": "P09-I-022",
"source_ids": [
"P09-I-R-8"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Durable workflow per capability install",
"claim": "A partially-completed install becomes a resumable object rather than manual cleanup.",
"precedent": "Temporal MIT at this scope; DBOS is the lighter library-shaped alternative",
"limitations": "Adds a durable-execution dependency to the install path",
"rank": 22,
"disposition": "register"
}
Event-plane tenant boundary mirroring the state-plane boundaryrecord 23
{
"id": "P09-I-023",
"source_ids": [
"P09-I-R-12"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Event-plane tenant boundary mirroring the state-plane boundary",
"claim": "Subject hierarchy as the event tenant boundary so both planes share one mental model.",
"precedent": "NATS subject hierarchies",
"limitations": "NATS accounts-as-tenancy is inferred from architecture knowledge, not read from docs this run",
"rank": 23,
"disposition": "register"
}
Prefer permissive cores at every load-bearing layerrecord 24
{
"id": "P09-I-024",
"source_ids": [
"P09-I-C-9"
],
"evidence_class": "observed",
"observed": "2026-08-27",
"title": "Prefer permissive cores at every load-bearing layer",
"claim": "Electric over PowerSync for sync, NATS over Redpanda for events, y-sweet over Liveblocks for collaborative state, SeaweedFS for object storage.",
"precedent": "Licence bodies read this run",
"limitations": "SeaweedFS wins by elimination rather than competition, a named concentration risk",
"rank": 24,
"disposition": "register"
}
Cross-donor operations as compensating workflowsrecord 25
{
"id": "P09-I-025",
"source_ids": [
"P09-I-C-15"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Cross-donor operations as compensating workflows",
"claim": "Model durable cross-donor operations with explicit compensation rather than distributed transactions.",
"precedent": "Temporal per-action pricing is also design pressure toward fewer, coarser steps",
"limitations": "Compensation logic is bespoke per operation",
"rank": 25,
"disposition": "register"
}
Capability catalogue as embeddings plus relational filters in one queryrecord 26
{
"id": "P09-I-026",
"source_ids": [
"P09-I-R-7"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Capability catalogue as embeddings plus relational filters in one query",
"claim": "pgvector alongside relational predicates avoids a separate search service and its licence problems.",
"precedent": "pgvector is PostgreSQL-licensed",
"limitations": "Load-bearing only if semantic capability matching is in scope; that is P03/P12 territory",
"rank": 26,
"disposition": "register"
}
Deferred substrate optionsrecord 27
{
"id": "P09-I-027",
"source_ids": [
"P09-I-R-10",
"P09-I-R-15",
"P09-I-R-16",
"P09-I-R-17"
],
"evidence_class": "inferred",
"observed": "2026-08-27",
"title": "Deferred substrate options",
"claim": "DuckDB over exported Parquet for per-tenant usage reporting with no warehouse; pgmq for polyglot donor runtimes; Supabase Realtime as component-level change fan-out; RisingWave materialized views if batch recompute becomes the bottleneck.",
"precedent": "All licence-verified this run",
"limitations": "Each is a scale optimization, not a Sprint-1 pillar",
"rank": 27,
"disposition": "register"
}