docs(adr): ADR-0090 D12 status line and ADR-0086 row — the binding and env-set authoring rights retired (#23488)

[objectstack-fleet]

Part of #23488

Ruling of record 6181988435 on #23488 (letter A), item 5: the ADR-0090 D12 status line and the ADR-0086 row go as one Tier H docs PR for the maintainer's merge. The code half (the two tombstones, the D2 conversion, the containment change, the docs and showcase text) is the main PR, #23601. #23488 remains open until that main PR lands; this PR only records the decision in the ADRs.

What changes

• ADR-0090, Status block: one new Amended line. D12's position-to-set binding right and its environment-set authoring right are retired (AdminScope.manageBindings and AdminScope.authorEnvironmentSets, ADR-0049 enforce-or-remove). A position's sets and a permission set's body are environment definitions, and the definition write is manage_metadata's per ADR-0131 D3, never a delegate scope's. D12's what is user-to-position assignments (and direct set grants) inside the subtree; the line tells the reader to take D12's bindings and authoring clauses as superseded.
• ADR-0086, the adminScope row of the metadata/config table (line 446): the clause "authorEnvironmentSets keeps package-managed rows publish-only per this ADR" becomes: the scope assigns and grants and never authors a set; authorEnvironmentSets is retired (2026-10-15, this ruling) because a permission set is an environment definition whose write is manage_metadata's (ADR-0131 D3); package-managed sets stay publish-only per ADR-0086.

D9 needs no new carrier (ADR-0138 D3 item 5 and its pinned absence), as the ruling states, so ADR-0138 is untouched.

Verification

Diff: 2 files, +2 / -1, both under docs/adr/. Gate families derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at c45ec439d (merge base 32e03d2fd): 19 commands, each run with its exit code captured before any pipe. All 19 exit 0. pnpm --filter @objectstack/lint run check:doc-formula-expressions first exited 3 (PREREQUISITE NOT MET: @objectstack/formula not built in this worktree, so nothing was measured); after turbo run build --filter=@objectstack/formula --filter=@objectstack/lint it exited 0.

Tier H: every path is docs/adr/**. This PR stays draft and is landed by the maintainer. It carries skip-changeset: nothing under docs/adr/ is published.

维护者速读(草稿)

改了什么
两份 ADR 各改一处文字,不动任何代码。ADR-0090 的状态区加一行「已修订」:委派管理范围里的两项权限「管理岗位与权限集的绑定」和「编写环境权限集」退役。ADR-0086 权限归属表里 adminScope 那一行,删掉「authorEnvironmentSets 保持包内权限集只能发布」的说法,改为:委派范围只负责分配和授予,从不编写权限集。

为什么改
这两项权限早已没有任何入口在执行:它们管的「绑定行」和「权限集行」已随 ADR-0131 D3 退役,现在岗位包含哪些权限集、权限集里写什么,都是环境元数据定义,只有持有 manage_metadata 的管理员能改,委派范围根本读不到。管理员勾上这两个开关,被委派的人什么也得不到。您已批准裁决 A(退役);代码那半在主 PR 里,这份 PR 只是把决定写进 ADR,让以后读 ADR 的人不再以为分公司管理员可以改岗位定义。

风险与代价(含回滚)
纯文字,零运行风险。如果主 PR 最终没有落地,这两行就会和代码不一致,所以最好在主 PR 落地前后合并。回滚就是 revert 这一个提交。

席位意见

你要做的
看一眼这两行措辞是否准确;没问题就批准并合并(Tier H,只能由您落地)。建议与主 PR 同一批次处理。

---

Generated by Claude Code

[objectstack-fleet]

维护者速读

改了什么

• 两份 ADR 各改一处文字，不动任何代码。
• ADR-0090：状态区加一行「已修订（2026-10-15）」。委派管理范围里的两项权利退役：「管理岗位与权限集的绑定」和「编写环境权限集」。委派范围剩下的是：在子树内给人分配岗位、直接授予权限集。
• ADR-0086：权限归属表里 adminScope 那一行改写为「委派范围只分配和授予，从不编写权限集」。authorEnvironmentSets 已退役，因为权限集是环境定义，写入归 manage_metadata（ADR-0131 D3）。原有的「包管理的权限集只能发布」保留不变。

为什么改

• 这两项权利早已没有任何入口在执行。管理员勾上这两个开关，被委派的人什么也得不到。
• 你已同意裁决 A（退役）。代码那半在主 PR feat(spec)!: retire AdminScope.manageBindings and authorEnvironmentSets — delegation rights no door honoured (#23488) #23601 里，这份只是把决定写进 ADR，免得以后读 ADR 的人以为分公司管理员能改岗位定义。

风险与代价（含回滚）

• 纯文字，零运行风险。
• 唯一的风险是错位：如果主 PR feat(spec)!: retire AdminScope.manageBindings and authorEnvironmentSets — delegation rights no door honoured (#23488) #23601 最终没落地，这两行会和代码说法不一致。
• 回滚就是 revert 这一个提交。

席位意见

• 措辞我已逐句对过裁决原文 6181988435 第 5 项和 diff，准确。
• 建议在主 PR feat(spec)!: retire AdminScope.manageBindings and authorEnvironmentSets — delegation rights no door honoured (#23488) #23601 落地后（或同一批）合并。主 PR 不在受管面，契约复审通过、CI 全绿后由席位入队。
• 本 PR 是受管规则文本，席位还会补一次契约复审档复核，复核记录会落在这个 PR 上。

你要做的
看这两行措辞；没问题就批准（或直接合并），它只能由你落地。

席位核对

domain:spec seat 2 (#18549) · session session_01LFqdRsuM5nkqoJdHd5ztVk · 2026-10-15T04:36Z · head:

c45ec439d1d3cabd963b557e5660b67f84f293b8

1. Form.
   • Draft to main. The first line is Part of #23488, and no closing keyword appears.
   • 2 files, +2/−1, both under docs/adr/**: governed, so Tier H (check-governed-merges --pr 23602: 2 of 2 paths).
   • skip-changeset: docs/adr/** publishes nothing.
2. Against the ruling. Ruling 6181988435 item 5 asks for one ADR-0090 D12 status line and ADR-0086 :446. The diff is exactly those two hunks.
   • The new ADR-0090 line names the retired rights and the remaining what (assignments and direct grants inside the subtree).
   • The ADR-0086 row keeps its "package-managed sets stay publish-only" clause and drops nothing else. The draft speed read said that clause was deleted; the final one above corrects it.
3. Gates. Check-runs on this head per the dev's read: 43 in all, 32 success, 11 skipped, none failing.
4. Owed before landing.
   • A CONTRACT_REVIEW_TIER review of this governed text. It is queued behind the seat's two reviews in flight, because the subagent cap is 3.
   • An authorised approval from os-zhuang or hotlong. Review is requested from both in this act, and needs-user-decision marks the wait.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c45ec439d1d3cabd963b557e5660b67f84f293b8
Local-runs: none

PR #23602, Part of #23488 (ruling of record 6181988435, letter A, item 5: the ADR-0090 D12 status line and the ADR-0086 row as one Tier H docs PR). Governed by path (docs/adr/** ×2, check-governed-merges --pr 23602: Tier H), so the review is owed at the contract tier; the domain:spec seat 2 queued it behind its subagent cap (席位核对 6184515986, item 4), and the director seat (summon #37 continuation 2, served tier read at its opening marker 6181075948) serves it in-seat so the PR's four pieces are complete for the maintainer's click, 2026-10-15T04:48Z. Head c45ec439d on base 16abea884, 2 files, +2/−1. Read: both changed lines in full, the PR body, the final 维护者速读 and 席位核对 (6184515986), the ruling of record, ADR-0131 D3, and the head's check-runs (32 success, 15 skipped, 1 in progress at the read, 0 red).

① Derived judgments

1. ADR-0090, the Status block, one new Amended line. It names the two retired rights by their keys (AdminScope.manageBindings, AdminScope.authorEnvironmentSets), the route (ADR-0049 enforce-or-remove), the owner of the definitions they named (a position's sets and a permission set's body are environment definitions; the definition write is manage_metadata's per ADR-0131 D3, never a delegate scope's), restates D12's surviving what (user↔position assignments and direct set grants inside the subtree) and tells the reader to take D12's bindings and authoring clauses as superseded. That is ruling item 5's sentence in substance; D12's original text is not rewritten (a dated note, the ADR amendment discipline). Correct.
2. ADR-0086, the adminScope row of the metadata/config table. The class column is unchanged (metadata (definition) + config (grant)); the scoping clause (BU subtree + assignable-set allowlist + no self-escalation) survives; the clause "authorEnvironmentSets keeps package-managed rows publish-only" becomes "the scope assigns and grants; it never authors a set: authorEnvironmentSets is retired (dated, citing the ruling), because a permission set is an environment definition whose write is manage_metadata's (ADR-0131 D3), and package-managed sets stay publish-only per this ADR". The surviving half of the old clause is kept, as the final 速读 corrects the draft's wording. Correct.
3. Nothing else moves; ADR-0138 is untouched, as the ruling states (D9 needs no new carrier). Both relative links resolve on main. Correct.
4. Gates on the head: 32 success, 15 skipped by design, 0 red, 1 in progress (not a required docs check); skip-changeset is hung and right (docs/adr/** ships in no package). The PR body's 19-command derived union ran exit 0 per the dev (the one exit-3 re-ran 0 after the prerequisite build). Not re-run here.
5. The 速读 (final, 6184515986) is true of this head.

② Semver level

No package's files[] ships docs/adr/**; Clause-②: no is right. No schema and no public door moves; the review is owed by the governed-text face alone.

③ Boundary flags

Ordering: the ADR text records a decision whose code half is PR #23601 (draft, +1016/−112, 38 files, not yet landed). An ADR amendment records the ruling, not the tree, so it may land before, with or after #23601 without contradiction; if #23601 were withdrawn the ruling of record would still stand and the line would still be true. No repository, app/platform or published-contract boundary is crossed. The dev raised no open question. NOT MEASURED: nothing; the record is read-only.

Implemented-by: claude/issue-23488-adr-delegation-rights-retired
Reviewed-by: session_01LqNgdPZB2Jnr5HpGbaqLeB

VERDICT: PASS

[objectstack-fleet]

Maintainer's word on batch #348 (the governed-draft line for this PR: 「批准并合并，不必等代码主 PR #23601」): 「同意」, 2026-10-15T05:03Z. Director seat, summon #37 (continuation 2), session_01LqNgdPZB2Jnr5HpGbaqLeB.

Recorded on the PR as the protocol asks. The four pieces are complete: the final 维护者速读 and 席位核对 (6184515986), the contract review at CONTRACT_REVIEW_TIER (6184651864, PASS at c45ec439d), review requested from the governed approvers. Tier H: the approval and the merge are the maintainer's click; this seat submits no review and lands nothing on this PR. Nothing else is owed before the click; needs-user-decision stays until the merge.