ADR-0026 was reviewed; status flips proposed -> accepted with the
two open questions closed:
1. Person dedup at first sign-in. v1 looks up by entraOid only;
no email-based merging. Two distinct people genuinely can
share an email, and silent auto-merge would corrupt the
golden record. ADR-0027 introduces operator-confirmed
reconciliation; v1 takes the safe-by-default posture.
2. Org-hierarchy seed placement. Region / Delegation /
Etablissement codes ship inline in the Prisma migration as
reference data — slow-moving, environment-agnostic, single
atomic deploy. ADR-0027's Pléiades sync supersedes the
inline seed when it ships. user_scopes for the 19 test
personas stay in prisma/seed.ts (implementation PR 2) since
those are test-tenant-specific data.
Consequences section reworked to reflect the new dedup choice:
the email-fragility Bad-because is removed; a new Bad-because
documents the v1 cost (a self-signed-in Person + a later
Pléiades-imported Person look like duplicates until ADR-0027's
operator merge flow resolves them — observable, not silent).
CLAUDE.md updated:
- Roll-up bumped 0001 -> 0025 -> 0001 -> 0026.
- New Architecture bullet for the portal-side data model.
- Roadmap entry on @RequireScope Prisma resolver updated to
reflect ADR-0026 (accepted) and the two-PR implementation
phasing.
Index row flipped to accepted.
Julien Gautier