[pditommaso]

Adds adr/20261029-workspace-ownership.md, the design for making Wave records private to the Platform workspace that created them.

The ADR covers:

1. Ownership, visibility and access segregation. A record created by an authenticated request belongs to its Platform workspace, or to the user for a personal workspace. Visibility is explicit and defaults to public, so clients in use today keep their behaviour. A private record is readable only by members of its workspace, checked against the record's own Platform.
2. Data structure changes. A shared owner object and a visibility field on container, build, mirror and scan records, stored in the existing JSONB data, so no schema migration. Private builds put the owner in the build id.
3. View pages. The /view/… record pages check access using Platform's JWT cookie, with 401 and 403 pages; list pages hide private entries.
4. API changes. A new read API version with optional bearer auth. The current read API stays untouched initially, then is deprecated and removed on an announced date.

It also includes a six-PR implementation plan, tests, consequences and open questions for review.

Docs only, no code changes.

🤖 Generated with Claude Code