docs(plans): amend S02/S10 to send organization_id at provisioning

Bojan Marjanovicrequested to merge
bmarjanovic/449-monolith-organization-id-plan into main

Summary

!1391 (merged) shipped authz.resolveTuples sourcing the ADR-021 Organization Administrator bootstrap ancestor from a namespace's own organization_id, but every namespace has that column NULL until the GitLab monolith sends one at provisioning. !1391 (merged)'s own description flagged this explicitly as a follow-up outside the AR repo, with one open assumption: whether organizations.uuid is the same value a member's JWT carries as Subject.OriginID.

This amends the monolith spec and both plans that need to know about the field, so a future implementation MR has a plan to follow rather than a gap:

  • docs/specs/monolith/S10-activation-and-deactivation.md: adds organization_id to the Ruby client table's provision_namespace row, explains the fill-on-replay semantics, and records a Resolutions entry confirming the open assumption: Authn::TokenExchange::TokenIssuer#organization_uuid (ee/lib/authn/token_exchange/token_issuer.rb) sets a member's JWT origin_id claim to @user.organization.uuid directly, so organization.uuid is exactly the value AR's resolveTuples needs.
  • docs/plans/monolith/2026-08-06-s02-gitlab-api-namespace-client.md (S02 plan): Step 2's #provision_namespace signature gains organization_id: nil, sent in the body only when present; the provisioning-body redaction set grows from six fields to seven.
  • docs/plans/monolith/2026-08-04-activation-and-deactivation.md (S10 plan): Step 2's provisioning service now passes organization.uuid as organization_id on every call, including replays, so a namespace provisioned before this step existed still acquires the value with no backfill needed; the dependency on S02 Step 2 is sharpened to require the amended signature specifically.

Test plan

  • mise run lint:markdown clean on all three files.
  • mise run lint:links clean (fragment links to the new Research Findings and Step 2 cross-references resolve).
  • mise run lint:vale shows 0 errors (warnings are pre-existing across the doc set; this repo's own convention notes the local Vale hook does not enforce these -- Duo does, on the MR).
  • Docs-only change: no code, tests, or config touched.

Related to #449 (closed)

Merge request reports