---
id: architecture/oq-16-grant-identity-namespace
name: OQ-16 unblock — first cross-assembly record sharing
status: pending
depends_on: []
scope: narrow
risk: trivial
impact: component
level: research
tags: [external-trigger, deferred-oq]
---

## Description

Tracker for OQ-16 (`deferred(scope)`): the grant-key identity namespace.
Grants on `RepoRecord` key on opaque identity-id strings (ADR-011,
ADR-015 §7). Within one assembly those are alkcall's cluster-local
`Identity.id` — sufficient for v1. The question of a
globally-comparable id format (compound `{namespace}/{id}` shapes,
did-key/contract-derived identifiers, or (authority, local-id)
tuples) only becomes real when repo records are shared across
assemblies — the distributed-git/replicator phase, where a hub mirrors
grant state published by an external authority.

Constraints any resolution must satisfy are already recorded in the OQ
entry (ADR-015 §7): grants stay flat sets keyed on opaque strings;
alkgit never parses or interprets the id; collision-freedom is the
identity-provider's guarantee.

## Work

None while blocked. When the first cross-assembly record-sharing
deployment is designed (the distributed-git phase, or a platform app
that federates grant state), decide the id format: either a
payload-level namespace convention (alkgit-side, opaque strings with a
namespaced grammar) or a family-wide identity-id format (alkcall-level
change). Record the resolution in an ADR; update the OQ entry.

## Verification

- OQ-16 status matches `docs/architecture/open-questions.md`.
- If resolved: an ADR exists and the grant-schema freeze inventory
  (OQ-03) reflects the chosen id format.

## Out of scope

- Building the distributed-git replication machinery (separate phase).
- Changing alkcall's `Identity` model (only if the family-wide option
  is chosen, and as that crate's own decision).

## Summary

> Filled on completion.