spec: `HierarchyScopeContext` cannot express ruling C — the null obligation is unconditional, so a spec-conformant resolver kills single-posture enterprise DEPTH

[claude]

Filed from the decision-inbox round-2 review of cloud#1148 (maintainer ruling 2026-08-07). This is the upstream half that blocks cloud#1196.

The seam

Two accepted positions contradict each other on origin/main:

1. The spec contract is unconditional. packages/spec/src/contracts/sharing-service.ts:456-468 states the resolver obligation as "null → owner-only, never widen", with no posture qualifier.
2. Ruling C ([#5852 producer 半边] resolveOwnerScopeIds 按权威字段填充 hierarchy resolver context + 补「resolver 收到的 org 非空」断言 #5859, landed via PR fix(plugin-sharing): hierarchy resolver 按权威字段拿到调用方活动组织 (#5859) #6067) requires widening in single posture. Under single (no-organization) deployments the producer consults the resolver, feeds an explicit null, and expects DEPTH to apply as usual.

HierarchyScopeContext carries no posture field, so a resolver has no legal way to satisfy both: any spec-conformant implementation (e.g. cloud PR #1196, which fail-closes unconditionally) kills hierarchy visibility for single-posture enterprise deployments.

Worth noting how this stayed green: the 20 single-posture e2e cases added by #6067 pass because the test-side resolver in packages/qa/dogfood/test/showcase-scope-depth.dogfood.test.ts:59-78 ignores organizationId entirely. No spec-conformant resolver is exercised by those cases, so the contradiction is invisible to CI.

Maintainer ruling (2026-08-07)

Enterprise DEPTH must keep working on single-posture (no-organization) deployments. So the contract has to make that legal rather than the resolver having to break the contract:

• add a posture signal to HierarchyScopeContext (so a resolver can distinguish "single posture, legitimately no org" from "org-scoped posture, org missing = fail-closed"), or write an explicit single-posture exemption into the contract prose;
• either way the fail-closed obligation must stay strict for org-scoped postures — that is the half that closes the cross-org escalation of ADR-0057 hierarchy DEPTH: the resolver's tenant isolation never engages — plugin-sharing passes organizationId: null while the active org rides in tenantId #5852;
• the dogfood cases should then exercise a spec-conformant resolver rather than an org-blind one, so the guarantee is actually pinned.

Downstream

cloud#1148 / PR #1196 are pm:blocked on this issue: the resolver's terminal shape (unconditional vs posture-aware fail-closed) follows directly from the choice made here. cloud's pin bump is independent and proceeds separately — the producer-side fix (#6067) already closes the escalation in deployment once the pin moves.

Refs: #5852, #5859, PR #6067, cloud#1148, cloud PR #1196, ADR-0057

Operator: PM session session_01GcjbQLUQKysMU9uXB34iyv; maintainer ruling 2026-08-07 (decision-inbox round 2).

---

Generated by Claude Code

[hotlong]

Release-board audit (maintainer-directed re-audit of non-board domain:spec items, 2026-08-07): adding target:v17 — criterion ②: the published sharing-service contract says null→owner-only unconditionally, while ruling C requires widening in the single posture; a conformant resolver kills enterprise DEPTH. Triage seat may veto.

---

Generated by Claude Code

[qq9340100]

认领(spec 车道 PM 代派,wave-5 工头卡 6/6)

• PM 会话:session_011M7UwH25Unfi73UHim7ajY(座位贴 [PM seat] domain:spec — 🟢 qq9340100 #6017)
• 实施会话:云工头 session_017LsRBm4LohvZJcjbSfkfeH(opus,单容器串行 6 单)
• 分支:claude/issue-6139-hierarchy-scope-posture-signal
• 容器判定:中卡(契约面 + dogfood 用例改造),不单独升舱,合舱工头容器
• 验收面:执行正文 2026-08-07 维护者裁决 —— 优先结构化 posture 信号(散文豁免为兜底,需报告说明不可行理由);org-scoped 的 fail-closed 义务保持严格(ADR-0057 hierarchy DEPTH: the resolver's tenant isolation never engages — plugin-sharing passes organizationId: null while the active org rides in tenantId #5852 那一半不动);showcase-scope-depth 用例改练 spec-conformant resolver;changeset FROM→TO 写清 single 姿态豁免语义。落地后由 unlock sweep 解锁 cloud#1148 / cloud PR 提升字段分组为ObjectSchema一等公民+规范fieldOrder自愈机制 #1196

交付走云卡降级通道:dev 推分支 + 报告 ref,PM 代开 draft PR 并转录终报。

---

Generated by Claude Code