id: design: mutating surface separation (from #5675) #5822

Summary

Follow-on design ticket from #5675 — its decomposition sketch names this as a separate design, and the parent's acceptance requires these tickets to be filed and linked. Filed in the 2026-11-04 gap pass (WS-F) so the design work exists and can be prioritised on its own merits; implementation timing is a separate decision, possibly months out.

What this design must settle

Whether queries may mutate: the permissions and audit separation for any mutating surface — or an explicit v1 'read-only only' decision record.

Context from the parent

The parent design fixes the filtering model, the owner-override boundary, surface parity, and pagination/result rules for querying local and remote ID servers. The parent issue carries the surrounding decisions this ticket must not re-decide; where this ticket's answer would change a parent decision, record that explicitly rather than silently forking it.

Decision record expected

Close this design with a recorded decision (on this issue or in a doc/ record linked from it): the chosen shape, the alternatives rejected and why, and the invariants implementation must hold. If the design splits further, file the splits and link them here rather than growing this issue.

Relations

Parent: #5675. Programme: epic #2056. Filed by WS-F (2026-11-04 ID design gap & expansion pass).