spec: HierarchyScopeContext cannot express ruling C — the null obligation is unconditional, so a spec-conformant resolver kills single-posture enterprise DEPTH #6139

Filed from the decision-inbox round-2 review of cloud#1148 (maintainer ruling 2026-08-07). This is the upstream half that blocks cloud#1196.

The seam

Two accepted positions contradict each other on origin/main:

1. The spec contract is unconditional. packages/spec/src/contracts/sharing-service.ts:456-468 states the resolver obligation as "null → owner-only, never widen", with no posture qualifier.
2. Ruling C ([#5852 producer 半边] resolveOwnerScopeIds 按权威字段填充 hierarchy resolver context + 补「resolver 收到的 org 非空」断言 #5859, landed via PR fix(plugin-sharing): hierarchy resolver 按权威字段拿到调用方活动组织 (#5859) #6067) requires widening in single posture. Under single (no-organization) deployments the producer consults the resolver, feeds an explicit null, and expects DEPTH to apply as usual.

HierarchyScopeContext carries no posture field, so a resolver has no legal way to satisfy both: any spec-conformant implementation (e.g. cloud PR #1196, which fail-closes unconditionally) kills hierarchy visibility for single-posture enterprise deployments.

Worth noting how this stayed green: the 20 single-posture e2e cases added by #6067 pass because the test-side resolver in packages/qa/dogfood/test/showcase-scope-depth.dogfood.test.ts:59-78 ignores organizationId entirely. No spec-conformant resolver is exercised by those cases, so the contradiction is invisible to CI.

Maintainer ruling (2026-08-07)

Enterprise DEPTH must keep working on single-posture (no-organization) deployments. So the contract has to make that legal rather than the resolver having to break the contract:

• add a posture signal to HierarchyScopeContext (so a resolver can distinguish "single posture, legitimately no org" from "org-scoped posture, org missing = fail-closed"), or write an explicit single-posture exemption into the contract prose;
• either way the fail-closed obligation must stay strict for org-scoped postures — that is the half that closes the cross-org escalation of ADR-0057 hierarchy DEPTH: the resolver's tenant isolation never engages — plugin-sharing passes organizationId: null while the active org rides in tenantId #5852;
• the dogfood cases should then exercise a spec-conformant resolver rather than an org-blind one, so the guarantee is actually pinned.

Downstream

cloud#1148 / PR #1196 are pm:blocked on this issue: the resolver's terminal shape (unconditional vs posture-aware fail-closed) follows directly from the choice made here. cloud's pin bump is independent and proceeds separately — the producer-side fix (#6067) already closes the escalation in deployment once the pin moves.

Refs: #5852, #5859, PR #6067, cloud#1148, cloud PR #1196, ADR-0057

Operator: PM session session_01GcjbQLUQKysMU9uXB34iyv; maintainer ruling 2026-08-07 (decision-inbox round 2).

Generated by Claude Code