docs(adr): ADR-0130 补记 —— 权限矩阵不在包边界的收益范围内（维护者 2026-09-02 决定，#14454 第 3 项取 B）；受管面，draft 交维护者合

[hotlong]

Part of #14122 · docs-only · docs/adr/** 是受管面：PR 保持 draft，由维护者合并。

决定（维护者 2026-09-02 在 PM 会话拍板）

#14454 第 3 项取 B：权限集整体留在 type: app 包，权限矩阵不在 ADR-0130 创造的包边界的收益范围内。 按包组合授权（模块把自己对象的授权贡献进 app 拥有的角色）另立平台卡作为分拆第二阶段（见 #14454 的后续评论），本次发版不做。

为什么要补记

ADR-0130 §1.3(a) 把 30 行 × 9 列 × 6 套的权限矩阵列为"没有边界"的三个可量化后果之一，并把包边界作为 Studio 一直缺的分组。hotcrm 分拆方案（objectstack-ai/hotcrm#1449，docs/architecture/module-split-plan.md §上游缺口 第 3 条）实测：HotCRM 6 套权限集里 4 套横跨 5–6 个模块——权限集按角色授权而不是按模块，它不能住在某个模块里，分拆后矩阵依旧是平的。ADR 的动机段因此有一句会被读者当成承诺，需要在 ADR 里写明它不是本 ADR 兑现的。

要做

在 docs/adr/0130-release-artifact-as-co-ownership-boundary.md 加一节补记（沿用该 ADR 已有的 §7 勘误/补记体例）：

1. 引 §1.3(a) 原句，说明权限矩阵的痛点不由包边界消除：权限集留在 app 包，Studio Access 分区里它们只出现在 app 包下。
2. 记录原因（跨域授权的本性 + hotcrm 实测数字）与决定日期。
3. 指向第二阶段的平台卡（按包组合授权）作为可能的后续，不承诺。

⛔ 不改 D1–D8 任何决定正文；⛔ 不碰 content/docs/releases/；只加补记，不改写 §1。

验收

一段补记、一个 changeset（docs-only 按仓库规矩：若 ADR 改动不需要 changeset，按 check-empty-changeset / 现行惯例处理）；PR draft；Governed Surface Queue Guard 会标记受管，维护者合。

[hotlong]

认领

• 会话：session_01UHvF5hyiZjnCyExFnfQB8m（PM 席）
• 分支：claude/issue-14487-adr-0130-permission-matrix-addendum
• 派发：os-dev，单卡，工作树 objectstack-14487；docs-only，docs/adr/** 受管 → PR 保持 draft，维护者合。

---

Generated by Claude Code

[hotlong]

os-dev-report

{
 "issue": 14487,
 "status": "done",
 "branch": "claude/issue-14487-adr-0130-permission-matrix-addendum",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/14498",
 "premise_still_valid": true,
 "summary": "Added one addendum section (93 lines, commit 018270546) to docs/adr/0130-release-artifact-as-co-ownership-boundary.md in that record's own '## Addendum (date, #card) — title' format, recording the maintainer's 2026-09-02 option-B ruling: permission sets stay whole in the `type: app` package and the 30 x 9 x 6 permission matrix §1.3(a) measures is NOT part of the payoff §4 claims for this boundary. It quotes §1.3(a) and §4 verbatim, carries the HotCRM measurement (hotcrm#1449: four of six sets span five or six of the six planned modules — sales_rep/sales_manager/system_admin 6, service_agent 5, marketing_user 4, guest_portal 2 — none confined to one module), states the sets appear under the app package only in Studio's Access pillar, and records what was NOT decided (#14488, phase two, no commitment) plus three constraints that phase inherits from ADR-0086 D3/D4/D7. No decision text moved: D1–D8, §1 and §3's non-goal on grouping keys are untouched, and no owner/publisher field was added; the only other edit is a one-sentence pointer appended to the Status line, following the ADR-0006 / ADR-0085 precedent for a record whose scope an addendum bounds. Changeset precedent followed: NONE, plus the `skip-changeset` label — every ADR-only commit over the last 30 touching docs/adr carries no changeset (including ADR-0130's own landing commit 682d03ba7 / #14151 and abeb5665e / #12867), and scripts/check-empty-changeset.mjs rejects a newly added empty-frontmatter changeset, so in this repo the label is the mechanism and an empty file is not. CHANNEL DECLARATION: repo-scoped REST is unavailable to this session — `gh` is absent and curl to api.github.com returned HTTP 403 'GitHub access is not enabled for this session' — so the label could not use the additive POST endpoint; it went through the MCP whole-set fallback (read current set, union, write, compare read-back). Read-back shows labels {documentation, skip-changeset}: skip-changeset landed and nothing was stripped. PR is DRAFT, governed surface (docs/adr/**), for maintainer merge — not auto-mergeable. The PR body was read back in full after creation and is intact through its footer. No out-of-scope defects were found; the one adjacent observation (after a split the app package owns the sets but no objects, so which Access door authors a packaged cross-module set's grants is unmeasured) falls inside already-queued #14488's scope, so it is recorded in the addendum as an input to that card rather than filed as a new one.",
 "tests": "Gate family derived with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` (script self-reported: tree of objectstack-ai/objectstack, change set 1 path — docs/adr/0130-release-artifact-as-co-ownership-boundary.md — 5 commands). All re-run AFTER the final commit, at `git rev-parse --short HEAD` = 018270546, serialised through `bash scripts/pm/os-verify-lock.sh -c ...` (slot issue-14487-gates; waits of 219s and 235s; VERDICT command-exit 0), every exit code captured into a file BEFORE any pipe: check-adr-links EXIT=0 ('check-adr-links: 600 relative link destination(s) under docs/adr/ resolve'); check:doc-formula-expressions EXIT=0 ('22 record-scoped formula example(s) across 427 files / 1398 TS blocks judged clean by @objectstack/formula'); check:adr-anchors EXIT=0 ('check-adr-anchors: OK (52 anchored file(s), every governing ADR still referenced; 31335 citation(s) across 4067 file(s) resolve)'); check:doc-authoring EXIT=0 ('394 files clean — no bare metadata literals'); check:pm-governed-merges EXIT=0 ('check-governed-merges --self-test: 243 assertions'); plus check:nul-bytes EXIT=0 ('scanned 7914 text file(s) ... no raw ASCII control bytes'), which the derivation does not name but every edit owes, and a hand scan of the edited file for raw control bytes (grep -naP over the 0x00-0x1f / 0x7f class, exit 1 = none found). NOT MEASURED, then measured: check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (@objectstack/formula unbuilt, then @objectstack/lint unbuilt). Exit 3 is 'nothing was measured', not a finding; both packages were built with `pnpm exec turbo run build --filter=... --concurrency=2` (EXIT=0 each) and the gate then ran green, which is the reading reported above. No ablation or reverse-verification applies — the diff is prose in one governed document, with no code path to mutate. Prose correctness was verified instead: every verbatim quote in the new section (ADR-0130 §1.3(a) and §4; ADR-0086 D4 twice and D7 once; hotcrm#1449's 'Ask' sentence) was checked whitespace-normalised against its source file rather than retyped, and the `[ADR-0086 D3]` anchor was confirmed real in packages/spec/src/security/permission.zod.ts. The per-set span figures come from hotcrm#1449's generated module-split-inventory.json (unmeasured_edge_classes), not from prose. The 9 further gate families dispatch-gates names are derived against a changeset path that, by the precedent above, this PR deliberately does not create. Per the standing contract, CI convergence is the PM's to read — no CI wait was performed.",
 "mcp_calls": "14 — every GitHub read and write this run, including this report comment and its read-back; REST was unavailable (403), so there was no cheaper channel for the writes",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code