CANARC-01 — Close Report¶
Brief: CANARC-01 — Three-phase canonical articulation arc (spine § 1 dispositional expansion + ADRs 020-023 + Phase 3 reconciliation across spine § 3, § 7, ADR-007, ADR-008, ADR-012 + new NO-WEAPONISED-LOCK-IN standing rule)
Origin: Tim + Claude morning session 2026-05-27; Tim handed Alex three drafts (Phase 1, Phase 2, Phase 3) for integration.
Authority: Standalone canonical articulation arc. Not in the RECON-FOUNDATION-LENS-01 §5 queue (which lists naming/identity/wrapper conformance work); CANARC-01 fills out the dispositional layer + access-control commitments that the recon framed as forward-referenced briefs (ADR-020 / ADR-021 / ADR-022 / ADR-023 series).
Executed: 2026-05-27 — Gate 1 substrate-bytes pressure-test produced 5 sharpenings; Gate 2 staged integrated drafts across three files; Gate 3 reviewed full bytes pasted in chat; Gate 4 commit 8522c6e3; Gate 5 this report.
Status: Closed cleanly. 1 commit unpushed, held for Tim push instruction.
1. What was articulated¶
Phase 1 — Spine § 1 dispositional expansion¶
Two new sub-blocks appended after "Why architectural discipline matters specifically here":
- The sentinel posture — three load-bearing principles compose: substrate-as-sentinel-not-as-product (closed loop runs continuously regardless of any particular customer), no-weaponised-lock-in (customer's work persists across absence; substrate retains audit trail; resumption is frictionless), interface-as-revelation (system discloses its own use rather than tutorialising customer into compliance). The lens question — does this decision express the sentinel posture, or does it violate it? — is the discipline that keeps downstream structural decisions coherent.
- Why this disposition matters commercially — disposition as moat the substrate moat is wrapped in. Names what the disposition does in the market and why competitors cannot copy it by adding features.
Phase 2 — Four new ADRs¶
- ADR-020 — Three-tier access-control model. T3 operator / T4 client administrator / T4A client user. T4 and T4A are separable concepts not separable humans. Multi-administrator extension designed-in but not built in initial implementation. Cross-client access structurally impossible at user layer.
- ADR-021 — Plan, entitlement, metering as substrate concerns. Plan attaches to client file; T4 admin role does not consume a seat; consumption transparency is architectural commitment ("not buried in invoice details after the fact").
- ADR-022 — Operator support uses impersonation pattern. T3 enters T4 substrate via view-as-if-customer surface; hatch closure on exit; comprehensive operator-side audit logging; default architecture is logging without customer-facing notification.
- ADR-023 — Graceful degradation across subscription state. T4 admin survives lapse; T4A users deactivate-not-delete; substrate state persists; resumption is frictionless. No-weaponised-lock-in expressed structurally.
Phase 3 — Six reconciliation changes¶
- spine § 3 — "Internal organisational complexity" sub-block updated to reference ADR-020's T4/T4A and ADR-022 cross-client access.
- spine § 7 — "The two-layer identity model" sub-block replaced with "The access-control model" (three-tier articulation). User-credential separation, Cloudflare-first paragraph, and Federation-as-future-credential-type sub-block stay intact. Pending identity work list gets one composition note added.
- ADR-007 — composition note added (user maps to T4A; T4 administrator role is conceptually distinct from user identity).
- ADR-008 — composition note added (T3 is substrate-operating tier not commercial tier; no-platform-tier statement remains accurate at the commercial layer).
- ADR-012 — composition note added (first signup → T4A user identity with pending T4 admin role; CEO confirmation establishes T4 admin authority).
- standing-rules — NO-WEAPONISED-LOCK-IN added at end of "Operating principles" section, after MANDARIN DATA TAXONOMY.
2. Gate-by-gate¶
| Gate | Activity | Output |
|---|---|---|
| 1 | Substrate-bytes pressure-test | 5 sharpenings: ADR-007 consequence count fix (6 not 5); multi-admin softening to "designed-in but not built initially"; consumption-transparency wording confirmed strong; T3/T4/T4A tier nomenclature confirmed; NO-WEAPONISED-LOCK-IN placement at end of Operating principles (not new sub-section) |
| 2 | Drafts staged | 4 header pins + spine § 1 expansion + spine § 3 replacement + spine § 7 replacement + spine § 7 pending-identity-work addition + spine closing-line pin + ADR-007/008/012 composition notes + ADRs 020-023 appended + NO-WEAPONISED-LOCK-IN inserted |
| 3 | Tim review of bytes | Approved with 3 forward observations recorded (see § 4 below) |
| 4 | Commit | 8522c6e3 — single coherent commit per METADATA-RECONCILIATION-AT-COMMIT discipline. 3 files changed, 199 insertions, 11 deletions |
| 5 | Close report | This document |
3. Sharpenings landed (Gate 1 outcomes)¶
The Gate 1 substrate-bytes pressure-test produced sharpenings that landed in the committed bytes:
- ADR-007 consequence count — Phase 3 draft said "after the existing five"; substrate had six consequence bullets. Fixed at drafting; the new composition note is the 7th bullet.
- ADR-020 multi-admin wording — softened from "near-term extension worth keeping the door open for" to "designed-in but not built in initial implementation; the schema and code accommodate the extension when its case is real." Preserves substantive commitment without implying a schedule.
- ADR-021 consumption transparency — strong wording confirmed and retained ("approaching-threshold and overage states are surfaced through the admin surface, not buried in invoice details after the fact"). The wording IS the architectural commitment the no-weaponised-lock-in principle demands.
- Tier nomenclature — T3/T4/T4A confirmed. Lexical continuity with UCCA historical conceptual lineage; writing-tightness across canonical text and downstream briefs.
- NO-WEAPONISED-LOCK-IN placement — at end of "Operating principles" section, after MANDARIN DATA TAXONOMY. No new sub-section. Operating principles already houses dispositional content (CLOUDFLARE-FIRST, OPERATING-CALIBRATION, MANDARIN DATA TAXONOMY).
4. Forward observations (Gate 3 + Gate 1 carry-forwards)¶
Gate 3 forward observations¶
4.1 ADR doc header pin density. This commit produces a long single-paragraph header (line 7) capturing the full evolution of the ADR document. Functionally correct; worth noting as a pattern that may eventually need a separate changelog section if header complexity continues to compound. The header now traces: initial 13 ADRs → ADRs 014-018 evening append → ADR-006/007 refinements → ADR-018 three refinements + minor refinement at canon reconciliation → ADR-019 → ADRs 020-023 + composition notes. Five distinct evolution milestones in one header paragraph. Pattern worth watching — at one more milestone, a separate "History" section in the ADR doc may earn its place. Not blocking this commit.
4.2 Spine § 1 stylistic divergence. The new sentinel-posture sub-block uses bold-prefixed paragraph leads (**Substrate as sentinel, not as product.**, **No weaponised lock-in.**, **Interface as revelation, not instruction.**) rather than ### sub-headers within the sub-block. Defensible because the three named principles are tightly coupled within one concept; ### headers would over-structure them and break the flow. But it's a rhythm difference within § 1 worth noting — existing § 1 sub-blocks use ### headers (Trajectory / "didn't start here" / Why architectural discipline). The new sub-block does use ### for its top-level "The sentinel posture" header, but the three principles inside it are bold-leads rather than #### sub-sub-headers. The choice was deliberate — the three principles describe one disposition, not three separate disciplines. Worth being aware of for future § 1 expansions.
4.3 Canonical foundation compounding. This commit adds +191 net lines across spine, ADRs, and standing-rules. Substantial expansion of canonical foundation in one commit. Future briefs reference more canon than they did yesterday morning. Trajectory across the two-day arc: spine v2 rewrite + 13 initial ADRs → 5 ADR refinements + ADRs 014-018 → ADR-019 → canon reconciliation + ADR-018 minor refinement → CANARC-01 (+ADRs 020-023, composition notes, new standing rule). The canonical foundation has roughly doubled in size since spine v2 landed 2026-05-26 morning. Worth being conscious of when calibrating Tier 2+ briefs — reference docs are denser; brief authors and Alex need more orientation time per new piece of work. Not a flaw of CANARC-01; it's the load the discipline is generating.
Gate 1 forward observations carried forward¶
4.4 METADATA-RECONCILIATION-AT-COMMIT — third observable application, promotion-threshold reached. Per yesterday's close report §8: "one more application earns promotion to formal standing rule per close report §8." That application has now happened. The candidate rule has accumulated three observable applications:
| # | Date | Brief | Form |
|---|---|---|---|
| 1 | 2026-05-26 | SPINE-AND-ADR-05b | Header pin caught one commit late; discipline articulated |
| 2 | 2026-05-26 | CANON-VS-ADR-018-RECONCILIATION-01 | Clean application (4 header pins / cross-references in commit) |
| 3 | 2026-05-27 | CANARC-01 (this brief) | Clean application (4 header/closing-line pins in commit) |
Promotion to formal standing rule is now warranted. The candidate-rule [[project-metadata-reconciliation-at-commit]] memory entry has tracked this; promotion happens via a small standing-rules update brief. Per recon §5 Tier 1 #3, this is one of three Tier 1 standing-rules promotions queued (alongside RECON-PASS-ON-FOUNDATION-SHIFT and recon-docs-at-position-4b).
4.5 Mandarin lexical real-estate observation. Carried forward from Gate 1. The word "Mandarin" carries two distinct meanings in current canon: ADR-019/022 sense (prod-vs-dev architectural separation at credential-surface layer) and standing-rules HARD SEPARATION RULE sense (regulatory training-data segregation: NRT vs micro vs ops). These are non-overlapping concerns; no current conflict. No action this commit. Forward observation: if naming friction emerges as future briefs reference both senses in adjacent text, the prod/dev sense may warrant a different label (e.g. "the prod/dev wall"); the regulatory-data-segregation sense has substrate-wide reach via HARD SEPARATION RULE and is more foundational.
4.6 Reciprocal-composition discipline observation. Phase 3 applied the principle implicitly: composition notes happen on the ADRs whose substantive scope is touched by the new ADRs (007 user model, 008 platform-tier statement, 012 signup flow); one-direction references happen where the newer ADR depends on the older without modifying it (ADR-022 → ADR-019, ADR-021 → ADR-009, ADR-023 → ADR-010). Worth articulating as a candidate-rule shape for future codification: "Reciprocal composition notes happen where the older ADR's own scope is constrained or extended by the newer ADR; one-direction references happen where the newer ADR depends on the older without modifying it." Not yet at promotion threshold (this is its first articulated application); future application during downstream identity / wrapper conformance work will accumulate evidence for promotion.
5. Recommended next brief drip — per recon §5 Tier 2 sequencing¶
Per Tim's close-report instruction: candidates per recon §5 Tier 2.
Tier 2 order (post-recon foundation):
| # | Brief | Why now |
|---|---|---|
| 6 | IDENTITY-MODEL-RATIONALISATION-01 | Step 0 for OPS-DB split. Blocks several downstream identity briefs. Now has ADR-020 as target shape to rationalise toward (T4 administrator role-attachment + T4A user identity per canonical articulation). |
| 7 | BUS-PATTERN-CF-IMPLEMENTATION-DECISION-01 | Decision; unblocks bus implementation work per ADR-017 |
| 8 | OPS-DB-SPLIT-SHAPE-DECISION-01 | Decision; unblocks ops-db split execution |
| 9 | CREDENTIAL-PROVIDER-DECISION-01 | Unblocks ADMIN-AUTH-MODEL-RECONCILIATION-01 |
| 10 | APPS-AND-ROUTE-NAMING-SCOPE-DECISION-01 | Names boundary of ADR-018 scope |
Recommendation: IDENTITY-MODEL-RATIONALISATION-01 first (recon Tier 2 #6).
Three reasons it earns the next drip:
- Target shape now exists. ADR-020's T4/T4A model is the canonical target for the rationalisation work. Before this commit, IDENTITY-MODEL-RATIONALISATION-01 had to rationalise toward a target it had to derive itself. Now it has a target to apply to four current identity conventions.
- Substantively unblocks downstream work. OPS-DB split, ADMIN-AUTH-MODEL-RECONCILIATION-01, EXTRACT-CUSTOMER-DATA-TO-CUSTOMER-DB-01 are all blocked on identity resolution. Landing this brief opens multiple downstream queues.
- Recon §5 Tier 2 #6 by sequencing. Tim's framing of "per recon §5 Tier 2 sequencing" puts this at first position.
Parallel candidate (Tier 1 leftover): the standing-rules promotion brief landing METADATA-RECONCILIATION-AT-COMMIT + RECON-PASS-ON-FOUNDATION-SHIFT + recon-docs-at-position-4b. Small, fast, three discrete rules landing as one commit. Could interleave with IDENTITY-MODEL-RATIONALISATION-01 between Gates if context window allows, or land before if Tim prefers "clear the foundation queue completely before tier 2."
Tim's call which to drip first.
6. Canonical doc state at close¶
| Doc | Lines added | Lines removed | Net change | New top-level structure |
|---|---|---|---|---|
architecture-decisions.md |
148 | 6 | +142 | 23 ADRs total (was 19) |
client-spine.md |
48 | 12 | +36 | §1 now has 5 sub-blocks (was 3); §3 and §7 sub-blocks revised |
standing-rules.md |
14 | 1 | +13 | Operating principles section now has 7 rules (was 6) |
| Total | 210 | 19 | +191 |
Commit 8522c6e3. 1 unpushed commit, held until Tim push instruction. Close report committed alongside in same push window (separate commit per the precedent established yesterday at CANON-VS-ADR-018-RECONCILIATION-01 close).
7. Process notes¶
Same gate discipline as CANON-VS-ADR-018-RECONCILIATION-01. Gate 1 substrate-bytes pressure-test → Gate 2 staged drafts → Gate 3 full-bytes paste for review → Gate 4 single coherent commit → Gate 5 close report. The discipline is becoming routine; pattern fits canonical-articulation work of any shape.
Substrate-state pressure-test surfaced minimal contradictions. CANARC-01 is purely doc-edit work (no substrate touched), so the pressure-test produces composition flags rather than substrate-state contradictions. The contradictions earned ground in earlier substrate work (canon reconciliation); the doc-edit work earns ground in composition discipline.
Brief drip rule held. CANARC-01 ran while RECON-FOUNDATION-LENS-01-Tier-2 work was queued but not in flight. One brief at a time; this brief in flight from Gate 1 morning until Gate 5 now. Next brief drips on Tim instruction.
End of close report. Brief drip moves to next brief on Tim push instruction + drip selection. Tim's call on whether to push the canonical articulation arc commit standalone or alongside the close report commit.