scholarr: decide D6 global identity authority #6

New issue

Open

opened 2026-08-20 11:32:05 +02:00 by justinzeus · 0 comments

justinzeus commented

2026-08-20 11:32:05 +02:00

Owner

Charter: runbooks/rewrite/charter.md

Goal

Owner decision D6 is answered on the record, and docs/specs/data-model.md reflects the answer.

Constraints

One of the seven blockers from the Card C.1 independent architecture review (2026-07-23, four adversarial dimensions over the e36e486 draft), which returned NO-FREEZE. All seven were spec-text gaps, not design flaws; the revision applying every finding is committed at a8c5939.
The question: Who may perform merges and record negative-identity tombstones in a multi-user system?
The draft's recommended answer: Restrict merges and negative-identity tombstones to an administrator role; non-admin review actions affect only that user's own follow and library rows.
What answering it decides: Whether one user's identity judgment changes the global, deduplicated publication store for everyone. New in the review; the original draft had no answer. Directly shapes the v1 auth model, which the charter locks to three modes.
This is an owner decision. An agent may lay out consequences and tradeoffs; it may not answer it.
The answer goes in the ## Owner decisions table of docs/specs/data-model.md, and any spec text it changes is edited in the same change.
The immutable doctrine in the charter binds any answer: no Google Scholar network contact, official APIs only, SQLite only, FollowedAuthor as the root entity.
Practical check: the two real users today are Justin and his dad. An answer that only works with one administrator who understands identity merges is a fine answer, but say so explicitly rather than leaving it implied.

Acceptance

The answer is recorded in the ## Owner decisions table of docs/specs/data-model.md
Any spec text the answer changes is edited in the same commit
The decision and its reasoning are stated in a closing comment here

Next action

Put D6 in front of the owner with the recommended answer and its consequence.

Charter: runbooks/rewrite/charter.md ## Goal Owner decision **D6** is answered on the record, and `docs/specs/data-model.md` reflects the answer. ## Constraints - One of the seven blockers from the Card C.1 independent architecture review (2026-07-23, four adversarial dimensions over the `e36e486` draft), which returned **NO-FREEZE**. All seven were spec-text gaps, not design flaws; the revision applying every finding is committed at `a8c5939`. - **The question:** Who may perform merges and record negative-identity tombstones in a multi-user system? - **The draft's recommended answer:** Restrict merges and negative-identity tombstones to an administrator role; non-admin review actions affect only that user's own follow and library rows. - **What answering it decides:** Whether one user's identity judgment changes the global, deduplicated publication store for everyone. New in the review; the original draft had no answer. Directly shapes the v1 auth model, which the charter locks to three modes. - This is an **owner decision**. An agent may lay out consequences and tradeoffs; it may not answer it. - The answer goes in the `## Owner decisions` table of `docs/specs/data-model.md`, and any spec text it changes is edited in the same change. - The immutable doctrine in the charter binds any answer: no Google Scholar network contact, official APIs only, SQLite only, `FollowedAuthor` as the root entity. - Practical check: the two real users today are Justin and his dad. An answer that only works with one administrator who understands identity merges is a fine answer, but say so explicitly rather than leaving it implied. ## Acceptance - [ ] The answer is recorded in the `## Owner decisions` table of `docs/specs/data-model.md` - [ ] Any spec text the answer changes is edited in the same commit - [ ] The decision and its reasoning are stated in a closing comment here ## Next action Put D6 in front of the owner with the recommended answer and its consequence.