[CT-803] Append revocation, compensation, and incident outcomes

[flyingrobots]

ADR-THINK-001 · Delivery plan · Complete issue catalog

Milestone: ADR-THINK-001 P8 — Action bridge and production cutover

Feature: F8.2 — Revocation, compensation, audit, and cutover

Outcome

Later evidence can stop future action, request a compensating operation, or record an irreparable incident without mutating the original authorization or pretending an effect was undone.

User stories

• As a Think user, I want a truthful response when a premise or authority is later retracted, so that the system repairs what it can and does not rewrite what already happened.
• As a auditor, I want linked authorization, execution, revocation, compensation, and incident records, so that historical legality and later regret remain separately inspectable.

Deliverables

• ActionRevocation, CompensationRequest, CompensationReceipt, and ActionIncident record contracts.
• Prospective revocation and bounded compensation policy.
• Impact classifier for reversible, compensatable, and irreversible external effects.
• Operator/user surfaces explaining original permission, changed evidence, attempted repair, and residual consequence.

Acceptance criteria

• A later retraction or authority loss never mutates the original authorization or execution receipt.
• Revocation blocks future execution and replay after its effective frontier.
• Compensation is a separately authorized bounded operation rather than causal rollback.
• An irreversible or failed-to-compensate effect produces an explicit incident with residual impact.

Test plan

Contract and unit

• Outcome tests cover prospective revocation, reversible compensation, partial compensation, irreversibility, and historical replay.

Integration and acceptance

• A simulated action is later invalidated and follows revocation, compensation, and incident paths with linked witnesses.

Failure and recovery

• Retroactive mutation, automatic inverse assumptions, unapproved compensation, double compensation, revocation race, and hidden residual effects fail.

Resource and performance

• Impact scans, revocation fan-out, compensation retries, and incident evidence remain bounded by affected receipts.

Security, privacy, and erasure

• Only authorized actors can revoke or compensate, and incident payloads remain redacted/erasable where required.

Build-time resources

Resource	Exclusivity mode	Scope
action-outcome-schema	exclusive	Revocation, compensation, and incident contracts.
compensation-policy	exclusive	Effect classification and authorization requirements.
affected-action-index	partitioned	Disjoint authorization and operation partitions.
compensation-execution-lane	exclusive	One bounded compensation per original effect.
historical-action-receipts	shared	Read-only authorization and execution evidence.

• exclusive: Only one active slice may mutate or lease the named resource.
• partitioned: Concurrent writes are lawful only in disjoint partitions named by each slice.
• shared: Concurrent read-only use is lawful; this slice does not mutate the resource.

Dependencies

• Blocked by #96 — CT-802

ADR traceability

• Implementation gates: None directly
• Constitutional invariants: I8, I9, I10
• ADR acceptance criteria: AC19, AC35

Non-goals

• Do not claim an irreversible external effect can be causally rolled back.
• Do not infer the inverse of an operation without a separately defined compensation contract.