Change scope derivation to skip missing levels instead of gap-filling

[amavashev]

Summary

This PR updates the scope derivation model in the Cycles protocol to skip missing hierarchy levels instead of filling them with "default" values. This simplifies scope paths, reduces configuration overhead, and makes the system more intuitive for operators.

Key Changes

• Scope path generation: Missing intermediate levels (e.g., workspace, app) are now omitted from scope paths rather than filled with "default". For example, tenant:acme/workspace:default/app:support-bot becomes tenant:acme/app:support-bot.

• Enforcement semantics: Clarified that reservations are enforced only at derived scopes that have budgets defined — at least one scope must have a budget. Scopes without budgets are skipped during enforcement.

• Documentation updates:

  • Renamed "Gap-filling with defaults" section to "Gap-skipping"
  • Updated all examples to reflect the new behavior
  • Clarified that operators only need to create budgets at levels they actually use
  • Updated the normative protocol specification in the OpenAPI schema

• Affected files:

  • protocol/how-scope-derivation-works-in-cycles.md — core documentation with examples
  • protocol/querying-balances-in-cycles-understanding-budget-state.md — balance query examples
  • protocol/dry-run-shadow-mode-evaluation-in-cycles.md — dry-run response examples
  • public/cycles-protocol-v0.yaml — normative protocol specification

Notable Details

• The canonical hierarchy order remains unchanged: tenant → workspace → app → workflow → agent → toolset
• Only explicitly provided subject levels appear in derived scope paths
• This change reduces scope path complexity and configuration burden while maintaining hierarchical budget enforcement

https://claude.ai/code/session_01VX9Vx5UAarAsStv5rB3D2z