[CT-705] Publish structural AnswerWitnesses with erasable payloads

[flyingrobots]

ADR-THINK-001 · Delivery plan · Complete issue catalog

Milestone: ADR-THINK-001 P7 — Authority and refusal readiness

Feature: F7.2 — Sufficiency enforcement readiness and answer witnesses

Outcome

Every answered or bounded query explains its frontier, clocks, evidence, readings, relations, authority, capabilities, bounds, and omitted guarantees without permanently retaining answer text.

User stories

• As a Think user, I want an explanation of why an answer was allowed and what it omitted, so that I can inspect confidence limits without trusting an opaque summary.
• As a privacy operator, I want separate erasure of quotations, summaries, and answer text, so that audit structure can survive without preserving deleted content.

Deliverables

• AnswerWitness canonical codec and validation law.
• Encrypted derived-payload grants for answer text, quotations, and summaries.
• Answered, Bounded, NeedsWork, and Refused response integration.
• Witness inspection and historical replay tooling with redacted/erased states.

Acceptance criteria

• Answered and Bounded results contain complete structural witnesses for every evidence and authority path used.
• The witness states temporal bindings, capability requirements, guarantees used, bounds, and omitted guarantees.
• Content-bearing output exists only in a separately erasable encrypted grant.
• After erasure, the witness remains structurally valid but cannot reveal or reconstruct the deleted payload.

Test plan

Contract and unit

• Witness tests cover required references, clocks, frontiers, authority, capabilities, bounds, omissions, and deterministic validation.

Integration and acceptance

• Every planner result type renders a lawful user response and inspectable witness across the dojo queries.

Failure and recovery

• Missing evidence, wrong frontier, capability mismatch, orphan payload, partial publication, and erased payload return typed states.

Resource and performance

• Witness construction and inspection stream reference sets with bounded payload, lookup, memory, and process use.

Security, privacy, and erasure

• Erasure and backup drills prove answer payload text is unavailable while structural receipts remain valid.

Build-time resources

Resource	Exclusivity mode	Scope
answer-witness-schema	exclusive	Canonical structural witness and validation rules.
derived-payload-vault	exclusive	Answer, quotation, and summary grant lifecycle.
answer-publication-session	exclusive	Atomic witness and payload-reference publication.
witness-fixture-partitions	partitioned	Disjoint result, temporal, authority, and erasure cases.
canonical-evidence-history	shared	Read-only witness references at pinned frontiers.

• exclusive: Only one active slice may mutate or lease the named resource.
• partitioned: Concurrent writes are lawful only in disjoint partitions named by each slice.
• shared: Concurrent read-only use is lawful; this slice does not mutate the resource.

Dependencies

• Blocked by #87 — CT-605
• Blocked by #92 — CT-704

ADR traceability

• Implementation gates: None directly
• Constitutional invariants: I9, I10, I15, I17
• ADR acceptance criteria: AC5, AC13, AC14, AC19, AC28, AC30, AC32

Non-goals

• Do not inline content-bearing quotations or summaries into irreversible witnesses.
• Do not treat an AnswerWitness as proof of objective truth.