fix(liveness,contract): position ledger rename + externalSharingModel classification + downstream fixture

Liveness: GOVERNED kind role→position; liveness/role.json→position.json
(flat, parent dropped); permission ledger rowLevelSecurity.positions;
object ledger gains externalSharingModel as 'authorable' with the P1
shape-only rationale and the #2696 pointer. Downstream-contract sharing
fixture moves to the position recipient.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H

Author: claude

packages/downstream-contract/src/additional-domains.fixtures.ts

@@ -50,7 +50,7 @@ export const DcSharingRule: SharingRuleInput = {
   object: 'dc_account',
   condition: 'record.stage == "customer"',
   accessLevel: 'read',
-  sharedWith: { type: 'role', value: 'dc_manager' },
+  sharedWith: { type: 'position', value: 'dc_manager' },
   active: true,
 };
 

packages/spec/liveness/object.json

@@ -248,6 +248,10 @@
     "searchableFields": {
       "status": "live",
       "note": "objectql `$search` executor (ADR-0061: expandSearchToFilter in engine.find) + objectui list/lookup/command-palette; canonical searchable-field source."
+    },
+    "externalSharingModel": {
+      "status": "authorable",
+      "note": "[ADR-0090 D11] P1 lands the SPEC SHAPE only (validated external<=internal at authoring). Runtime consumption (audience-aware evaluator branch) is scheduled with the principal-taxonomy semantics phase; tracked on the ADR-0090 tracking issue (#2696)."
     }
   }
 }

packages/spec/liveness/permission.json

@@ -139,10 +139,10 @@
           "status": "live",
           "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts"
         },
-        "roles": {
+        "positions": {
           "status": "live",
           "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts",
-          "note": "flat match — no subordinate rollup."
+          "note": "flat match — no subordinate rollup (ADR-0090 D3 rename)."
         },
         "enabled": {
           "status": "live",

packages/spec/liveness/position.json

@@ -0,0 +1,19 @@
+{
+  "type": "position",
+  "_note": "PositionSchema (ADR-0090 D3; formerly RoleSchema). Flat capability-distribution group.",
+  "props": {
+    "name": {
+      "status": "live",
+      "evidence": "packages/core/src/security/resolve-authz-context.ts:210",
+      "note": "sys_position.name keys position-bound permission-set resolution and ctx.positions."
+    },
+    "label": {
+      "status": "live",
+      "note": "display (admin nav/forms, security-plugin.ts)."
+    },
+    "description": {
+      "status": "live",
+      "note": "display."
+    }
+  }
+}

packages/spec/liveness/role.json

@@ -53,7 +53,7 @@ const repoRoot = resolve(specRoot, '../..');
 const ledgerRoot = join(specRoot, 'liveness');
 
 // Governed metadata types, rolled out highest-frequency / highest-risk first.
-const GOVERNED = ['object', 'field', 'flow', 'action', 'hook', 'permission', 'role', 'agent', 'tool', 'skill', 'dataset', 'page'];
+const GOVERNED = ['object', 'field', 'flow', 'action', 'hook', 'permission', 'position', 'agent', 'tool', 'skill', 'dataset', 'page'];
 
 // ADR-0010 provenance/lock overlay fields — system-stamped, on every type; auto-live.
 const FRAMEWORK_FIELDS = new Set([