docs(specs): specify the permission verdicts for UI gating

João Pereirarequested to merge
jdrpereira/s09-permission-checks-spec into main

What

Amends S09 with the permission checks ADR-021 defines for UI gating:

  • New ### Permission verdicts design section: one BatchCheck item per surface with the tuple-read rules the point checks use, action sets fixed by resource level (namespace 7, repository 9, list rows included), strict result-cardinality consumption (violations answer 503, never a deny), and Cache-Control: private.
  • New endpoint GET /api/v1/:slug/namespace (slug, created_at): carries the namespace verdicts on pages with no other management call. Gate is the no-permission binding variant — authenticated plus the ADR-020 organization comparison — with the cross-organization caller answered by the unknown-slug 404.
  • include_permissions (boolean, follows include_referrers) on the namespace details, repository detail, and repository list operations.
  • The list 200 becomes a {"repositories": [...]} envelope on every call; verdicts add keys, the shape never switches. S17's list contract is updated in the same MR so the two specs agree. The monolith client (monolith/S02) migrates in a monolith MR the implementation plan must carry.
  • Listing section and acceptance criteria reconciled: a namespace role settles visibility only; requested verdicts still evaluate the returned rows. Seven new criteria (21–27) pin the gate, the verdicts, the opt-out, and the fail-closed consumption.

Spec status stays Approved; the merge is the approval signal.

Related to #670 (closed)

Merge request reports