Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0021
ADR-0021: Edge accounting over the transitive closure; boundary changes are loosening
| field | value |
|---|---|
| Status | Accepted |
| Date | 2026-07-24 |
| Register | factory (docs/adr, 4-digit ids) |
| Source | docs/adr/0021-edge-accounting-over-transitive-closure.md — permalink at bdafa201a (unchanged on master since that commit) |
| Wiki register entry | ADR-0021 (wiki status: Accepted) |
The record
- Status: Accepted
- Date: 2026-07-24
- Spec: SPEC-033 §1
Context
The edge budget (pre-authorised cross-component dependencies per ratified contract) exists to keep routine coupling changes from each becoming a human event. As specified — count new declared cross-component edges, budget refilled per ratified contract — it is gameable three ways:
- Boundary redefinition. Merge two components and the cross-component edge simply vanishes: identical coupling, zero budget spent. Worse, the differential classifier likely scores the merge as a tightening (fewer edges to violate), so it passes on quorum.
- Indirection laundering. A→B and B→C already exist; introducing a dependency of A on C through B is new coupling with zero new edges.
- Refill drift. The budget resets per change, so N edges × many changes is unbounded cumulative coupling growth with no accounting anywhere.
Note this ADR overturns an explicit round-3 finding: Fable assessed the budget as not a laundering channel, reasoning that bidirectional diagram certification forces every spent edge to be re-rendered at ratification. That defence holds for edges that continue to exist — it does not cover the case where the edge is eliminated by moving the boundary. Opus's attack is decisive; recorded here so the disagreement and its resolution are not lost.
Decision
- Component-boundary changes (merge/split/move) are loosening by definition — human ratification, never quorum-only, regardless of how the edge count moves.
- Count coupling over the transitive reachability closure, not just declared direct edges, so indirection through an existing hop is visible.
- The budget is cumulative against trunk, with an explicit repayment rule (coupling removed returns budget), rather than refilling per change.
Alternatives rejected
- Direct-edge counting with per-change refill (as specified) — all three attacks above.
- No budget at all — every new edge becomes a human event; the liveness failure ADR-0021 exists to prevent.
- Rely on diagram re-ratification alone — Fable's position; sound for surviving edges, blind to boundary elimination.
Consequences
- Boundary refactors — often legitimate and desirable — now require human ratification. Accepted: boundary changes are precisely the architecturally significant ones.
- Transitive-closure counting is more expensive and will surface coupling that direct-edge counting hid; expect an initial baseline that must be frozen rather than fixed (a ratchet, not a gate).
- Cumulative budgeting requires trunk-level coupling accounting to be a durable, tracked fact.
Provenance
Round-3 Opus (#10) with all three attacks; Round-3 Fable (C-6) had assessed the budget as safe. The panel disagreement was resolved in favour of Opus on the boundary-redefinition case, which Fable's reasoning does not cover.
Related ADRs
No other ADR is named in this record.
Rulings cited
None.