Anti-fork Customization

1) The problem this lesson solves

A customer branch can look fast on day one while quietly splitting upgrade, security-patch, QA, and support paths from the shared product. This lesson governs the variation surface; it does not mutate live infrastructure.

2) Lesson boundary and deliverable

The deliverable is Anti-fork Customization Decision Contract v1. ARC-022 does not own ARC-021 SLA/support outcomes or COM-001 site information architecture, and it performs no live fork, migration, billing, or tenant mutation.

3) Fact: one codebase can have many deploys

The Twelve-Factor App describes one codebase with many deploys. Deploys may run different revisions, but they share the same codebase. This is a boundary pattern, not MAKNOW's commercial fork policy.

4) Fact: keep deploy-varying config separate from code

Twelve-Factor defines config as values likely to vary between deploys and calls for separation of config from code. A deploy-specific value therefore does not automatically require a source patch—but arbitrary config still needs schema, ownership, and test evidence.

5) Fact: Kustomize bases and overlays

Kubernetes Kustomize documents bases and overlays: a base has no knowledge of an overlay and can be reused by multiple overlays. That demonstrates one bounded variation pattern; it does not by itself prove that a commercial customization is supportable or secure.

6) A public extension contract is not an internal hook

A public, versioned extension has an explicit contract. A plugin coupled to an unversioned internal API has hidden upgrade risk. Kubernetes Custom Resources and controllers are examples of declarative API-extension mechanisms, not permission to depend on arbitrary internals.

7) Separate the decision paths

Classify each request as bounded configuration, entitlement, declarative overlay, public extension, upstream product change, companion service, explicit fork exception, or decline/hold. “Customer-specific” is not a sufficient variation type.

8) Preserve the Canonical Core

canonical_core_ref must remain traceable across deployments. Once a customer source patch becomes the operational source of truth, the system has forked even if the branch is still called temporary.

9) Compatibility and upgrade evidence are separate gates

A compatibility_window is not enough by itself; upgrade_test_ref must bind the customization to the target core/extension version. A successful old baseline does not prove the next upgrade.

10) Security patch path is critical

If an urgent fix can ship to the canonical core but the customer divergence cannot receive it cleanly, the customization is not merely inconvenient. The security propagation path is broken and the decision must remain blocked until repaired.

11) Expose support impact and divergence budget

support_owner, support_tier_impact, and divergence_budget make operational cost visible. Customer divergence creates QA, incident, and patch obligations that cannot be hidden under the label of a small customization.

12) Core Evidence Contract

The contract has 24 evidence dimensions, including 16 critical dimensions. The compact table below shows baseline, branch divergence, and recomputed transfer; JSON/CSV files retain the full mapping.

13) Fork Exception requires authority and rejoin/sunset

FORK_EXCEPTION is not a default path. It requires explicit exception authority, a trigger, a time/condition-bound rejoin or sunset plan, patch path, and support impact. A fork with no end condition is a permanent fork with a temporary name.

14) Typed states prevent fake success

HOLD_EVIDENCE_MISSING, HOLD_CONFIG_UNBOUNDED, HOLD_COMPATIBILITY, BLOCKED_SOURCE_DIVERGENCE, and BLOCKED_SECURITY_PATCH are valid outputs. Missing evidence must not be converted into acceptance by guesswork.

15) Lab and transfer

The lab uses eight fixtures and 48 assertions. In transfer, the extension schema changes, an urgent security fix must reach every deployment, and a second request depends on an internal implementation detail. The learner must recompute from changed evidence; the baseline is never the oracle.