[Decision] DESIGN.md §04 makes clm_requester every employee's default, but a set that grants clm_requester.access cannot bind to everyone #11

维护者速读

事情：DESIGN.md §04 说 clm_requester 是「所有员工默认」的权限集，同时又说导航分区的门控能力 clm_requester.access 由这个权限集的 systemPermissions 授予。平台的规则是：带任何 systemPermissions 的权限集属于高权限集，不能挂到 everyone 锚点（ADR-0090 D5/D9）。运行时在启动时拒绝绑定并打警告，os lint 直接报错（security-anchor-high-privilege）。所以「默认给所有员工」在这个平台版本上没有自动机制，卡 04 只能把它做成「分发」：七个岗位各自额外绑定 clm_requester（法务、财务、档案、管理员、两级领导都同时是发起人），没有岗位的普通员工由管理员在 Setup 里逐人授予。

为什么现在问你：改法有两个方向，一个改 §04 措辞，一个向平台提需求；两者都不是开发 agent 能定的。今天不定不阻塞 M1（验收测试用管理员逐人授予跑通了），但卡 07 要按 clm_requester.access 门控「我的合同」分区，到那时普通员工看不看得到这个分区，取决于这个决定。

选项：

• A（推荐）：接受分发模型，§04 加一句「clm_requester 由管理员授予未持岗位的员工；持岗位者随岗位绑定」。零改代码；同时向 objectstack 报一个平台缺口：应用自己声明的 capability（scope: 'org'）不该被算作高权限位。平台修好后，把 clm_requester 标成 isDefault 就能自动给所有人，这边只需删一行绑定。
• B：把 clm_requester.access 从 systemPermissions 拿掉，clm_requester 标成 isDefault: true 自动绑到 everyone；「我的合同」分区改为只要登录就可见（§04 与 §05 都要改一句）。
• C：新增第八个岗位 clm_employee，绑定 clm_requester，管理员给每个员工发岗位。§04「岗位七个」要改。

代价：A 多一步管理员操作（每个新员工），文档改一句，等平台修好可以收回；B 少一个门控能力，导航分区退化成「登录即见」，但和 §04 的 access 令牌体系不一致；C 多一个岗位，仍然要逐人发，只是从「发权限集」变成「发岗位」。

你要做的：回一个字母，A、B 或 C。

Context

DESIGN.md §04, verbatim:

Permission set 五个：clm_requester（所有员工默认）· clm_legal · clm_finance · clm_records · clm_admin。
导航分区的门控能力由权限集 systemPermissions 授予：clm_requester.access · …

The platform's only mechanism for "the set every authenticated member holds" is isDefault: true on the set, which auto-binds it to the built-in everyone position at boot (ADR-0090 D5). That binding is gated by describeHighPrivilegeBits (@objectstack/spec/security), whose first rule is: any non-empty systemPermissions makes the set high-privilege. Measured on 17.3.0:

• plugin-security bindBaselineToEveryone: refusing to bind fallback set to everyone — high-privilege bits { offending: "system permissions" } — a boot warning, and no binding.
• @objectstack/lint security-anchor-high-privilege (severity error): isDefault:true suggests binding this set to the 'everyone' audience anchor, but it carries system permissions — the runtime will refuse the binding (ADR-0090 D5/D9).

So §04's two sentences cannot both be satisfied automatically on this platform version. Card 04 (#4) implemented the distributed reading without editing §04:

• src/security/bind-position-sets.ts binds every one of the seven positions to clm_requester as well as to its own set (12 rows; measured on a running app);
• the two requester test accounts in the acceptance run received the set through sys_user_permission_set rows written by the seeded admin — the Setup path.

Governing text: DESIGN.md §04 (the two sentences above); AGENTS.md → Delivery process → a code PR never touches DESIGN.md §01–§04 without a needs-user-decision first; → Platform gaps → report, never patch.

Options

A — keep the tokens, state the distribution, report the platform gap. §04 gains one sentence; objectstack gets an issue proposing that an app-declared capability with scope: 'org' (ADR-0066 D1) not count as a high-privilege bit for the everyone anchor — manage_users and clm_requester.access are not the same kind of thing. When that lands, isDefault: true on clm_requester restores the automatic default and the seven extra bindings can go.

B — drop clm_requester.access, make the set isDefault. The "我的合同" navigation group (§05) is then gated by authentication alone. Consistent with the platform today; inconsistent with the five-token *.access scheme §04 and §05 build the navigation on.

C — an eighth position, clm_employee. Keeps every token; changes "Position 扁平，七个" and turns the per-employee admin step into a position assignment rather than a set grant.

四棱分析

实际业务需求 — A 或 C。业务上「所有员工都能发起合同」是产品定位（§01），门控能力是卡 07 导航分区的基础；B 把「我的合同」分区退化成登录即见，短期无害，但一旦客户要按员工类型（例如外包、实习）收窄「谁能发起」，B 没有开关。A 保留开关。

项目长远合理性 — A。矛盾在平台的高权限判定粗于 ADR-0066 的能力模型（应用能力令牌与平台系统权限被一视同仁），根因应回到平台修；应用侧 A 的代码在平台修好后可整体收回，B 与 C 都是把平台的粗糙固化进设计文本。

防 AI 写错 — A。三个方案里只有 A 不改 systemPermissions 的语义；B 让「一个权限集既是默认又不带令牌」成为惯例，下一个 AI 作者会在别的分区照抄，门控能力体系逐渐空心化；C 引入一个只为绑定而存在的岗位，与 ADR-0090「岗位是分发点」勉强相容，但七变八的理由是平台限制而非业务，容易被下一个读者当成业务岗位再挂规则。

创业阶段不扩散 — 三者都不扩散能力面。A 增加一步管理员操作与一条上游 issue；B 删一个令牌；C 加一个岗位。A 的成本最低且可逆。

结论：四棱同向 A。推荐 A。

Impact if deferred

M1 is not blocked: card 04's acceptance run staffed the requester accounts through Setup-equivalent grants and every refusal was observed. Card 07 (views/app) gates the "我的合同" group on clm_requester.access; an employee without the grant will not see it. Deciding before card 07 is dispatched avoids a second pass over the navigation.