[objectstack-fleet]

Refs #30922
Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：只改 ADR-0069 的文字（就地修订，状态行追加一条 2026-11-06 的「Amended in place」）：写明「组织级访问策略覆盖值」存放在设置的租户层（access_policy 命名空间，每个组织一行 sys_setting），而不是 sys_organization.* 字段；涉及 TL;DR 6、D3、D5、D7 四处，并在 D7 末尾加一段说明；另外 D3 的双重验证要求从「开关」改为三档 off / administrators / everyone（不强制 / 管理员必须开 / 全员必须开，管理员即 ADR-0090 D12 的租户级、组织级和委派管理员），部署级是默认值和下限，组织级同样三档、不得弱于部署级（可相同或更强）。
• 为什么改：执行你在 Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 上的裁决「修订 ADR 写明存放位置（推荐）」；PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 把这些值存在设置租户层，ADR 原文仍写组织表字段，两者不一致；三档双重验证依据你在 cloud#3668 的裁决「可以，按三档做（推荐）」，一并记入 ADR，免得再开第二个受管 PR。
• 风险与回滚：零运行时风险，只有文字，没有代码、spec、文档站改动；「组织只能收紧、不能放宽部署下限」这条规则原意不变，其他决策不变。回滚 = revert 这一个提交。
• 先看：docs/adr/0069-enterprise-authentication-hardening.md 的 D7 末尾新增说明段（风险最高：它写了存放位置和理由）；其次 D3、D5 两张表里改名的那一行，以及状态行末尾。
• 两分钟验证：git diff origin/main -- docs/adr/0069-* 应只见状态行末尾、TL;DR 6、D3 两行（存放位置与三档）、D5 一行、D7 一行的改写，加 D7 末尾 1 段新增说明；pnpm check:adr-index 应报告 docs/adr/README.md 为最新。
• 需要你做的：审阅后亲手合并（Tier H，草稿状态，席位不会转 ready、不入队、不开 auto-merge）。

What changes

ADR-0069 is amended in place on the maintainer's ruling recorded on #30922 (ruling record 6692407743, maintainer, verbatim: 「修订 ADR 写明存放位置（推荐）」). Per-organization access-policy overrides live in the settings tenant rung of ADR-0007 / ADR-0131: the tenant-scoped access_policy namespace, one sys_setting row per organization, as PR #31013 implements. TL;DR 6, D3, D5 and D7 named sys_organization.* columns. D3's mfa_required also changes from a global toggle to the three levels off / administrators / everyone, at the deployment and per organization, on the maintainer's ruling G2 on objectstack-ai/cloud#3668 (verbatim 「可以，按三档做（推荐）」). The tighten-only rule is unchanged in meaning, and no other decision changes.

The diff touches only docs/adr/0069-enterprise-authentication-hardening.md. pnpm adr:index ran and left docs/adr/README.md unchanged (the index shows a truncated status prefix, which this note does not reach), so the README is not in the diff. The status line stays on line 3, inside the index's 40-line header window.

Passage	Before	After
Status line (appended)	no 2026-11-06 note	"Amended in place (2026-11-06, ruling record 6692407743 on #30922, maintainer, verbatim 「修订 ADR 写明存放位置（推荐）」; implemented by PR #31013): per-organization overrides live in the settings tenant rung (the tenant-scoped access_policy namespace, one sys_setting row per organization), not in sys_organization.* columns, and D3's mfa_required is three levels, off / administrators / everyone, at the deployment (the default and the floor) and per organization (ruling G2 on objectstack-ai/cloud#3668, record 6684194038, verbatim 「可以，按三档做（推荐）」); the tighten-only rule is unchanged and no other decision changes (TL;DR 6, D3, D5, D7); see the note under D7."
TL;DR 6	"per-org overrides (sys_organization.*) are explicit and additive (an org can only tighten, never loosen, the global floor)"	"per-org overrides are explicit and additive (an org can only tighten, never loosen, the global floor) and live in the settings tenant rung: the tenant-scoped access_policy namespace, one sys_setting row per organization", with a store-amended marker
D3, deployment row	"mfa_required (global toggle)"; "When mfa_required, a session for a user ..."	"mfa_required (deployment level: off / administrators / everyone)" with a levels-amended marker; "When the level covers the user (everyone: every user; administrators: the tenant-level, organization-level and delegated administrators of ADR-0090 D12), a session for a user ...". Default off, seam unchanged.
D3, per-org row, setting cell	sys_organization.require_mfa (per-org)	access_policy.mfa_required (per-org, settings tenant rung), with a marker that the column is retired. Seam cell unchanged. The mechanism cell gains "on the same three levels: off (nothing beyond the deployment's) or a level at least as strong as the deployment's, never a weaker one (off, then administrators, then everyone)".
D5, first row, setting cell	sys_organization.allowed_ip_ranges (CIDR[])	access_policy.allowed_ip_ranges (CIDR[], per-org, settings tenant rung), with a marker. Seam and mechanism cells are unchanged.
D7, field list	"sys_organization: require_mfa, allowed_ip_ranges"	"per-organization overrides: no sys_organization field; they live in the access_policy settings namespace", with a marker
D7, new closing note	(none)	Records where the values live and that the deployment's auth values are the default and the floor. Restates the tighten-only rule. Gives the reason: only a settings write predicate receives the saving request's transport, which the per-organization self-lock-out save guard needs, and the settings rung is the store organization administrators already write. Records that sys_organization.require_mfa is retired (readonly, migrated) and that no sys_organization.allowed_ip_ranges field is added.

Acceptance notes

• The dated implementation-status snapshots are left as written, because they record what was true on their dates: D7's "Implementation status (2026-07-04)" paragraph and the Phasing table's P1 and P2 rows still say sys_organization.*. The new note says so.
• D3 records the three MFA levels at the deployment and per organization, on the maintainer's ruling G2 on objectstack-ai/cloud#3668 (record 6684194038, verbatim 「可以，按三档做（推荐）」). The status-line note gains one clause for them. The per-organization row allows a level at least as strong as the deployment's, never a weaker one.
• On purpose, nothing about PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's in-rework mechanics is described here (the concurrent cap, the organization-switch rules).

Verification

All readings were taken at head f3ce9c02b3, where the gates were re-run after the wording commit (review 6694338252 S1/S2). dispatch-gates warned that the tree is 6 or more commits behind origin/main and that scripts/regen-artifacts.mjs (not in this diff) changed across that range. The derived list was identical to the first run's. main was not merged into the open PR (AGENTS.md section 10); CI runs on the merge ref.

Derived gate families (dispatch-gates --commands, 21) — 20 exit 0, 1 NOT MEASURED

• node scripts/check-adr-links.mjs (and --self-test): exit 0 / exit 0
• node scripts/check-closing-keyword-parity.mjs (and --self-test): exit 0 / exit 0
• node scripts/check-comment-mask-corpus.mjs: exit 0
• node scripts/ci/plan-test-core-shards.mjs --self-test: exit 0
• pnpm check:adr-anchors, check:adr-index, check:adr-symbol-anchors, check:ci-filter-parity, check:closed-ceremony-text, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:pm-governed-merges, check:pm-prior-rulings, check:refd-timer-probe, check:watch-hint-literal: exit 0 each
• pnpm --filter @objectstack/lint run check:doc-formula-expressions: exit 3, PREREQUISITE NOT MET (@objectstack/formula / @objectstack/lint not built). NOT MEASURED locally, a declared narrowing. Two 9-minute queue attempts for the prerequisite build on the shared verify lock timed out (exit 99) behind another run. CI's Lint & Repo Gates runs this family.
• dispatch-gates --ran reconciliation: "21 derived famil(ies) accounted for — 20 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3)", exit 0.

ADR index

node scripts/adr-index.mjs: exit 0, "adr-index: unchanged docs/adr/README.md (237 lines)."

Docs only, under the docs/adr/** fast path: nothing publishes, so no changeset is added and this PR carries skip-changeset.

---

Generated by Claude Code

[objectstack-fleet]

repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

Contract-review-claim: session_01Q4EjjRhUZjdy8VXs6Kkur2 · head 27e0710 · 2026-11-06T20:01Z

Face: governed path docs/adr/** (Tier H). An in-place amendment to ADR-0069 records the per-organization access-policy store (the access_policy settings tenant rung) and the three MFA levels, both already ruled → reviewed by an isolated reviewer the seat starts now. The maintainer merges; the seat never does.

[objectstack-fleet]

repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 27e0710231f35229a8359dc7cb8bf4e2d98eb22e
Local-runs: none
Scope: docs/adr/0069-enterprise-authentication-hardening.md + docs/adr/0007-settings-manifest-and-kv-store.md, docs/adr/0131-total-organization-ownership-no-null-organization-id.md, docs/adr/README.md (origin/main), scripts/adr-index.mjs, and on PR #31013's branch claude/issue-30922-per-org-access-policy: packages/plugins/plugin-auth/src/organization-access-policy.ts, packages/plugins/plugin-auth/src/organization-access-policy-binding.ts, packages/plugins/plugin-auth/src/allowed-ip-ranges.ts, packages/services/service-settings/src/manifests/access-policy.manifest.ts, packages/services/service-settings/src/settings-service.ts, packages/services/service-settings/src/settings-routes.ts

Rendered 2026-11-06T20:07Z. Tier and face: record-recognisers --template --paths docs/adr/0069-enterprise-authentication-hardening.md prescribes the rules face (a governed path, docs/adr/**, Tier H), so CONTRACT_REVIEW_TIER; hits is the one ADR file. Read-only: the net diff origin/main...27e0710231 (one file, +23/-6), the PR body, card #30922 (body and every comment, rulings 6692407743 and 6693179169's claim, #31013's contract review 6692495550), objectstack-ai/cloud#3668's comments (ruling record 6684194038), ADR-0069 in full at the head, and #31013's branch for the floor rule and the write-predicate transport. Nothing built, run or re-run. The maintainer merges; the seat never does.

Check-runs on the head, read once at 2026-11-06T20:04Z: 20 success, 19 skipped, 0 failure, 4 in_progress. Green: Governed Surface Queue Guard, Lint & Repo Gates and all seven Lint lanes (ESLint, docs & code guards, repo & tooling gates, CI/release/engine gates, PM dispatch-gates, scoped lanes), Type Check · source gates, Check Documentation Links, Check PR Size, PR-body guards, Dogfood Regression Gate, Test UI, Plan Test Core shards, Auto Label, filter. NOT MEASURED (in_progress, not polled): Type Check · workspace, Type Check · debt ledger, Type Check · consumer gates, Test Core (1/8). Check Changeset: skipped (skip-changeset, docs only).

① Derived judgments

1. The diff moves only what the two rulings cover — holds. The hunks are: the status line (one appended Amended in place clause); TL;DR 6 (store wording); D3's deployment row (toggle to three levels) and per-organization row (store and levels); D5's first row, setting cell only (store); D7's field list (store); and one new closing note under D7. Every other sentence of the ADR is byte-identical to origin/main. The tighten-only rule reads the same in TL;DR 6 ("an org can only tighten, never loosen, the global floor"), in the D3 per-organization row ("above the global floor") and in the D7 note ("may only tighten, never loosen, the deployment's floor"). D1, D2, D4, D6, the seam summary, Phasing, Consequences and the Addendum are untouched. TL;DR 6 still keeps the security knobs at scope global under manage_platform_settings; the tenant rung is added beside it, not in its place.
2. The rulings are stated verbatim, with their record ids — holds. Status line and D7 note: ruling record 6692407743 on Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922, 「修订 ADR 写明存放位置（推荐）」, character for character what comment 6692407743 carries. Status line and D3: ruling G2 on objectstack-ai/cloud#3668, record 6684194038, 「可以，按三档做（推荐）」, character for character what comment 6684194038 carries. Both are attributed to the maintainer, both linked to the comment anchor. The ruling's own words bind the scope the amendment takes: "TL;DR 6, D3, D5 and D7 name sys_organization.* columns today. The tighten-only rule is unchanged." The amendment names exactly those four places.
3. The "why" for the store is accurate against feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's code — holds. settings-routes.ts hands every settings write SettingsWriteOptions.transport (the request's headers and remoteAddress); settings-service.ts narrows it to the headers the predicate named at registration (narrowTransport, registerWritePredicate(..., { requestHeaders })) and passes it into the predicate; organization-access-policy-binding.ts registers allowedIpRangesWritePredicate over the manager with recovery: false on access_policy.allowed_ip_ranges with FORWARDED_CLIENT_ADDRESS_HEADERS, and that check refuses a list that does not admit the saving request's own address. No engine, core or spec file on origin/main outside the HTTP server contract knows a peer address, so an object-field write door would not receive it. The manifest's header also confirms the second half of the why: scope tenant, writePermission: 'setup.write', "written by the organization's administrators". The ADR sentence "only a settings write predicate receives the saving request's transport, which the per-organization self-lock-out save guard needs (an organization's IP list must still admit the request that saves it)" describes what ships.
4. The per-organization MFA rule matches feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's floor rule; no off loophole — holds. feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's rule table (organization-access-policy.ts): an organization may save "off; or a level at least as strong as the deployment's"; enforced is "the stronger level of the two" on the rank off, then administrators, then everyone, effectiveMfaLevel = strongerMfaLevel(floor, organization). The manifest says the same: "Off = the deployment's requirement". The ADR's D3 per-organization row: "off (nothing beyond the deployment's) or a level at least as strong as the deployment's". So an organization's off under a deployment administrators is not a loosening: off is the key's zero value and the deployment's level holds at enforcement (strongerMfaLevel('administrators', 'off') is administrators). The ADR does not describe off as switching the requirement off, and the status line names the deployment value as "the default and the floor". The ordering off, then administrators, then everyone is the code's rank. One wording wrinkle in that same cell: S1 below.
5. The levels at the deployment match the ruling — holds. D3's deployment row: off / administrators / everyone, default off, administrators = "the tenant-level, organization-level and delegated administrators of ADR-0090 D12" — the ruling's own definition ("ADR-0090 D12's tenant-level, organization-level and delegated administrators"), and the card's Expected 2. The seam cell (post-sign-in session gate) and the un-stepped-up mechanism are unchanged; only the trigger sentence moved from "When mfa_required" to "When the level covers the user".
6. feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's in-rework mechanics are not described — holds. The ADR says nothing of the concurrent-cap population, the organization-switch judgement, the roaming-session re-judgement, the tenant-administrator exemption of the self-lock-out check, or the retired-option refusal (S1–S8 of record 6692495550). What the D7 note does record of feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 — sys_organization.require_mfa retired as readonly, each true moved to access_policy.mfa_required = everyone, no sys_organization.allowed_ip_ranges added — is the card's own Expected 2 ("Map require_mfa and the global flag onto the levels, with a migration") and the part of feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 its review judged right (①.6 there), not a should-fix. The D5 first row's seam and mechanism cells are deliberately untouched (observation O1).
7. The status line stays inside adr-index's window — holds. The line is line 3 of the file; HEADER_WINDOW = 40 in scripts/adr-index.mjs, and STATUS_LINE wants a line that starts **Status**:, which it still does. The keyword Accepted is the first word of the value, and the first ISO date in the value is still 2026-07-04, so the index row's status (truncated) and date columns are unchanged and docs/adr/README.md is rightly absent from the diff. Read, not run: the PR body's "unchanged (237 lines)" is the dev's reading and is not relied on.
8. The dated snapshots are left honestly dated — holds. D7's "Implementation status (2026-07-04)" still names sys_organization.require_mfa as landed and sys_organization.allowed_ip_ranges as not landed; Phasing's P1 row still says "per-org require_mfa" and the P2 row "Remaining: per-org sys_organization.allowed_ip_ranges ... tracked in [security][P2] Per-org / per-user IP allow-list (record-level allowed_ip_ranges) — ADR-0069 D5 #2571". Each is a reading of its date, and the D7 note says in so many words that "the dated implementation-status snapshots above and under Phasing are left as written". Every changed passage carries its own dated marker ("store amended 2026-11-06", "levels amended 2026-11-06") pointing at the note or the status line, so a reader at any row can tell the amended wording from the original.
9. Cross-references resolve. ADR-0007 (cascade, scope tenant) and ADR-0131 both exist at the head; the pairing "ADR-0007 / ADR-0131 tenant rung" is the ruling's own phrase. ADR-0090 D12 is the administrator definition the ruling names. Relative links are the registry's own form; Check Documentation Links is green on the head.

② Semver level

Docs only: one file under docs/adr/**, no package, no packages/spec path, no changeset (skip-changeset, Check Changeset skipped). Clause-②: no, Metadata-protocol: none on the PR body are right: nothing published changes. The settings shape the ADR now records (access_policy namespace, auth.mfa_required as a select) is #31013's narrowing, judged and recorded there (record 6692495550 ②), not here.

③ Boundary flags

• Tier H landing. The PR is a draft from the base repo (objectstack-ai/objectstack, not a fork), authored by objectstack-fleet[bot] on branch claude/issue-30922-adr0069-store-amendment. The maintainer merges by hand; this record lifts nothing and the seat does not flip, queue or arm it.
• The amendment lands independently of feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013. The ruling says feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 "does not wait on the amendment"; equally, this amendment cites feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 as "implemented by" while feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 stands at FAIL (6692495550) and its branch has moved past the reviewed head (now b0b494c04a). The ADR records where the values live and what the levels are — both already ruled — not that feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 has landed, so the citation is a pointer, not a status claim. Should feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 change its store or its level names in rework, this ADR would need a further line; nothing in its FAIL findings asks for either.
• cloud consumer. objectstack-ai/cloud#3668 is pm:blocked on Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 and carries the EE console over the platform's per-organization policy; it reads this ADR as the record of the store. Nothing in this diff reaches cloud code.

④ Design judgment

An ADR amendment judged against its first consumer (#31013's code, read above) and the rulings it records: the store sentence, the why, the floor rule and the level set all hold against the code; the amendment adds no decision of its own. Two wrinkles, neither a must-fix:

• S1 (should-fix) — D3 per-organization row, mechanism cell: "off (nothing beyond the deployment's) or a level at least as strong as the deployment's, a stronger level only (off, then administrators, then everyone)". The two clauses pull against each other: "at least as strong" admits an equal level (which feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's save predicate admits — a level equal to the deployment's is not refused), while "a stronger level only" reads as strictly stronger. The intent is clearly direction (tighten, never loosen), and the first clause is the one that matches the code, so no loophole opens; but a reader of the second clause alone would conclude an organization cannot save administrators under a deployment administrators. Replace "a stronger level only" with "never a weaker one" (or drop the phrase).
• S2 (should-fix) — D7 note's first sentence of the why cites "ADR-0007's cascade at scope tenant; ADR-0131". ADR-0131 decides organization ownership (no NULL organization_id), which is why the row is per organization, but the note does not say what it is cited for, so a reader has to guess. The ruling uses the same pairing, so this is carried from the record, not invented; one parenthetical ("ADR-0131: the row belongs to one organization") would close it.

Observation, not a finding:

• O1 — D5's first row now names the store from feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 (access_policy.allowed_ip_ranges) while its seam cell still reads "auth request middleware (Hono, before the better-auth handler)" and its mechanism cell "reject login/session outside the org's ranges". In feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 the organization's list is judged where a session is scoped to the organization (better-auth session.create / session.update hooks, and on its moved branch head, on later requests too) — the Hono gate ahead of better-auth judges the deployment's list. That seam is exactly what feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's review left in rework (S3 there), so leaving the cell untouched is right for this amendment, and the PR body says the seam and mechanism cells are unchanged on purpose. A seam amendment is owed once feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 settles; it is not this PR's.

Findings. No must-fix. S1 and S2 as above (should-fix, wording only).

Implemented-by: claude/issue-30922-adr0069-store-amendment
Reviewed-by: session_01Q4EjjRhUZjdy8VXs6Kkur2

VERDICT: PASS

[objectstack-fleet]

repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: f3ce9c02b3c9947bb91ad8697a080de5d0cdcc95
Local-runs: none
Scope: docs/adr/0069-enterprise-authentication-hardening.md + docs/adr/0131-total-organization-ownership-no-null-organization-id.md (D7 and its §1104 summary), packages/platform-objects/src/system/sys-setting.object.ts (origin/main), and on PR #31013's branch claude/issue-30922-per-org-access-policy: packages/plugins/plugin-auth/src/organization-access-policy.ts

Delta record rendered 2026-11-06T20:22Z, on the prior record 6694338252 (PASS on 27e0710231, should-fixes S1 and S2). Same tier and face: the rules face on the one governed path, CONTRACT_REVIEW_TIER. Read-only: git diff 27e0710231 f3ce9c02b3 (one commit, f3ce9c02b3, one file, +3/−2), the updated PR body, ADR-0131 at origin/main, the sys_setting object header, #31013's floor rule, and the head's check-runs read once. Nothing built or run. The maintainer merges; the seat never does.

Check-runs on f3ce9c02b3, read once at 2026-11-06T20:21Z: 15 success, 19 skipped, 0 failure, 7 in_progress. Green: Governed Surface Queue Guard, Check Documentation Links, Check PR Size, PR-body guards, Type Check · workspace, Type Check · debt ledger, Lint · PM dispatch-gates, the three Lint · scoped lanes, Dogfood Regression Gate, Test UI, Plan Test Core shards, Auto Label, filter. NOT MEASURED (in_progress, not polled): Lint · ESLint, Lint · docs & code guards, Lint · repo & tooling gates, Lint · CI, release & engine gates, Type Check · source gates, Type Check · consumer gates, Test Core (1/8). Check Changeset: skipped (skip-changeset, docs only). On the prior head all of these were green or docs-irrelevant; the delta is two prose lines in one ADR.

① Derived judgments

1. S1 is closed; the rule still matches feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's floor rule — holds. D3 per-organization row now reads "off (nothing beyond the deployment's) or a level at least as strong as the deployment's, never a weaker one (off, then administrators, then everyone)". The contradiction is gone: "never a weaker one" states direction, and no longer excludes an equal level. feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's save rule (organization-access-policy.ts): "off; or a level at least as strong as the deployment's" — an equal level is admitted, a weaker one refused (accessPolicyFloorRefusal, mfaBelow); enforced is strongerMfaLevel(floor, organization) on the rank off, then administrators, then everyone. The ADR sentence and the code now say the same thing, and the off reading is unchanged: off is the key's zero value, so an organization's off under a deployment administrators leaves administrators in force.
2. S2's parenthetical is accurate to ADR-0131's text — holds. The D7 note now reads "ADR-0131 (organization ownership is total: each such row is owned by its organization, and only the settings global rung leaves sys_setting)". ADR-0131's title is "Organization ownership is total — no NULL organization_id"; its D7 says "sys_setting's global rung leaves the tenant-scoped table: infrastructure values go to configuration; a tenant-less object holds only values an operator must change without a restart", and its summary line "Deployment-level settings leave sys_setting (D7)". The sys_setting object header on main confirms the shipped shape: a key declared scope: 'global' persists in the tenant-less sys_platform_setting ("ADR-0131 D7: the deployment-level rung left this tenant-scoped table"), the tenant and user rungs stay, and "WHICH organization owns the row is carried by the kernel-injected organization_id column". So "each such row is owned by its organization" and "only the settings global rung leaves sys_setting" are both ADR-0131's own claims, and they say what ADR-0131 is cited for: the access_policy row is one organization's row. The nesting (a parenthesis inside the ADR-0007 parenthesis) is a style wrinkle only.
3. Nothing else moved — holds. The delta is exactly two hunks in docs/adr/0069-enterprise-authentication-hardening.md: the D3 per-organization mechanism cell (one phrase) and the D7 note's ADR-0131 citation (one parenthetical, which pushes the note's third line onto a fourth). The status line, TL;DR 6, the D3 deployment row, D5, the D7 field list, the dated snapshots and every section the prior record found untouched are byte-identical to 27e0710231. The net diff against origin/main is still one file (+24/−6). No ruling text, record id, link or marker changed.
4. The PR body's quoted lines match the ADR — holds. The before/after table's D3 per-organization row quotes the mechanism cell with "never a weaker one (off, then administrators, then everyone)", character for character the ADR's; the Acceptance note says "allows a level at least as strong as the deployment's, never a weaker one"; the Verification head names f3ce9c02b3 and the prior record (6694338252 S1/S2). The D7 closing-note row describes the note in prose (store, floor, why, retirement) and does not quote the ADR-0131 parenthetical, which is a summary, not a misquote. The first three lines (Refs #30922, Clause-②: no, Metadata-protocol: none) are unchanged.
5. The status line is still line 3, inside the 40-line window — the delta touches lines 85 and 181–182 only.

② Semver level

Unchanged from the prior record: docs only, no package, no changeset, Clause-②: no, Metadata-protocol: none.

③ Boundary flags

Unchanged: Tier H draft from the base repo, the maintainer merges by hand; nothing here lifts, flips, queues or arms. The amendment still lands independently of #31013 (ruling 6692407743), which is at FAIL on its own record.

④ Design judgment

The two wording changes make the D3 per-organization rule read as the code enforces it and name what ADR-0131 is cited for. No decision moved and no new claim was added beyond ADR-0131's own. Observation O1 of the prior record (D5's seam cell is pre-#31013 and is owed a line once #31013 settles) stands and is still not this PR's.

Findings. None. S1 and S2 of record 6694338252 are closed by f3ce9c02b3.

Implemented-by: claude/issue-30922-adr0069-store-amendment
Reviewed-by: session_01Q4EjjRhUZjdy8VXs6Kkur2

VERDICT: PASS

[objectstack-fleet]

repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

维护者速读

• 改了什么： 只改 ADR-0069 的文字，就地修订。
  • 写明按组织的访问策略覆盖值存放在设置的组织层：access_policy 命名空间，每个组织一行 sys_setting，而不是组织表的字段。
  • 双重验证从「开关」改为三档：off / administrators / everyone。部署级是默认值和下限；组织级同样三档，可以和部署级相同或更强，绝不更弱。
• 为什么改： 执行你的两项裁决：Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 上的「修订 ADR 写明存放位置（推荐）」，cloud#3668 上的「可以，按三档做（推荐）」。PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 的实现和 ADR 原文不一致，先把 ADR 改对。
• 风险与回滚： 纯文字，没有代码改动。「组织只能收紧、不能放宽部署下限」这条规则原意不变。回滚 = 还原本 PR。
• 需要你做的： 审阅并亲手合并（受治理面 docs/adr/**，Tier H）。合并不必等 feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013。

席位意见： 建议合并。完整复核 PASS 6694338252，两处措辞改进并入后，增量复核 PASS 6694635563（head f3ce9c02），没有遗留待修项。

席位核对 · ACCEPT（Tier H，等维护者合并）· 2026-11-06T20:27Z

Head-sha: f3ce9c02b3c9947bb91ad8697a080de5d0cdcc95
Implemented-by: os-dev (session session_01Q4EjjRhUZjdy8VXs6Kkur2, branch claude/issue-30922-adr0069-store-amendment) · Reviewed-by: repo:cloud#3

• 形态： 1 个文件，docs/adr/0069-*.md（+24/−6）。改动：状态行加注明日期的「就地修订」说明；TL;DR 6、D3 两行、D5 一行、D7 一行改写；D7 末尾加一段说明，写清存放位置、理由，以及 require_mfa 退役。pnpm adr:index 跑过，目录零差异。GOVERNED，Tier H。PR 保持 draft，⛔ 席位不翻 ready、不入队、不挂 auto-merge。
• 门禁 check-runs（head f3ce9c02）：必需检查全部 success。
• 留待以后： D5 那一格写的是 feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 之前的拦截位置。feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 还在返工（关于组织 IP 名单在什么时候判定），等它定下来，再开一次小修订。
• 落地条款： Tier H。席位同时挂 needs-user-decision，并请审批人 os-zhuang（hotlong 是本席自己的账号，按规则不请）。维护者亲手合并即为审阅记录。