Define protected-effect contracts for authorization-bound state changes

[samovers]

Depends on: #10

Outcome

Define the content-addressed domain contracts that prove a committed record or event faithfully implements an authorization-bound effect intent.

Primary trust boundary

Domain effect semantics and commit classification: the boundary that owns result schemas, intent-to-result mappings, permitted derivations, forbidden widening, event/commit classes, and postconditions. This is separate from the authorization evaluator, which may only bind and consume the resulting contract identity and disposition.

Acceptance criteria

• Inventory every state-affecting authorization action and identify the existing domain contract that owns its result, or declare a narrowly scoped missing contract.
• Give every applicable protected-effect contract an immutable content reference, version, and digest.
• Define exact intent-to-result mappings, permitted derived fields, forbidden widening, event/commit classification, and postconditions in the owning domain contract.
• Produce an immutable validation trace with field-mapping and postcondition dispositions plus the intent, result, and contract digests.
• Require validation before commit; a mismatch aborts without rewriting the authorization result.
• Register the reviewed contract bindings for later inclusion in AuthorizationPolicyBundle v0.2.
• Add hostile cases for wider sharing rights, changed assertion bodies, wrong review-decision kinds, altered filing destinations, and substituted pack successor state.

Non-goals

No authorization-rule redesign, grant or revocation change, transaction-manager implementation, transport release, retention/key custody, current/default promotion, or production-readiness claim.

Delivery rule

Keep each domain-contract PR inside one effect-family trust boundary. If different event families require independent authority owners, split them into linked child issues rather than one catch-all PR.

What is next: complete the action-to-contract inventory and identify the first missing contract boundary.

[samovers]

Action-to-contract inventory — 20/20 actions

Inventory basis: the semantically approved Phase A authorization candidate at b0e0409a939539b85ce6d89105230aeb51e589ca, the active Event Grammar, accepted RFCs, and current/default machine-contract families. This is analysis only; it does not promote or amend any contract.

Action	Existing result owner or carrier	Gap and disposition
OBSERVE_CREATE_OBSERVATION	NarrativeObservation v0.1, AgronomicObservationContext v0.1, and MeasurementEvidence v0.1 cover different observation forms	No single contract owns the candidate's generic OBSERVATION result. A later observation-family issue must close subtype-to-result selection without flattening narrative, context, and measurement evidence.
OBSERVE_ATTACH_EVIDENCE	SemanticEventEnvelope v0.1 can classify an EvidenceEvent	No current EVIDENCE_LINK result carrier defines the exact governed-record/evidence/relation mapping. Missing evidence-link contract.
ASSERT_STRUCTURE	AssertionRecord v0.1 with STRUCTURE_ASSERTION	Existing carrier; protected mapping, forbidden widening, immutable target/result digest, event classification, and validation trace are missing.
ASSERT_OPERATION_CLAIM	AssertionRecord v0.1 with OPERATION_CLAIM_ASSERTION	Existing carrier; exact claim-body, performer provenance, payload-reference, and no-promotion mapping are missing.
ASSERT_COMPLIANCE	AssertionRecord v0.1 with COMPLIANCE_ASSERTION	Existing carrier; exact claim/evidence/policy mapping and prohibition on direct compliance-fact promotion are missing.
OPERATE_PLAN_INTERVENTION	PlannedIntervention v0.1 plus InterventionIntentPayload v0.1	Existing carriers; exact plan/intent composition, derivation, and postconditions are missing.
OPERATE_REPORT_EXECUTION	ExecutionRecordPayload v0.1 plus an AssertionRecord operation claim	No single EXECUTION_REPORT result contract owns the composition. A bounded execution-report composition contract is missing.
REVIEW_REQUEST	ReviewDecision v0.1 can carry REVIEW_REQUEST / REVIEW_REQUESTED	The candidate treats REVIEW_REQUEST as a distinct prospective subject, while active commit-class law does not classify it as a final governance decision. Keep this in a separate review-request boundary.
REVIEW_ACCEPT	ReviewDecision v0.1	Existing owner and GovernanceEvent / governance decision classification; exact intent/result mapping and immutable target-revision proof are missing.
REVIEW_REJECT_OR_CONTEST	ReviewDecision v0.1	Existing owner; the protected intent must select the closed REJECTED or CONTESTED result without permitting another outcome. Mapping and proof are missing.
REVIEW_SUPERSEDE	ReviewDecision v0.1	Existing owner; exact target/supersession mapping, no in-place rewrite, and postconditions are missing.
CONTEXT_INSTALL_PACK	Pack activation request/result/set contracts exist	No current PACK_INSTALLATION result carrier exists. Missing pack-installation contract; it must not be conflated with activation.
CONTEXT_ACTIVATE_PACK	SemanticEventEnvelope v0.1 as StructureEvent, plus PackActivationSet v0.1 and pack activation result/trace contracts	Existing components; a composite event-to-successor-set protected-effect contract is missing.
CONTEXT_DEACTIVATE_PACK	Same pack/structure carriers as activation	Existing components; exact deactivation selection and complete successor-set mapping are missing.
OUTPUT_APPROVE_DOCUMENT_ASSEMBLY	PublicationAssemblyResult v0.1 may be a carrier through FREEZE_DOCUMENT_ASSEMBLY / FROZEN	The approved action says approve, while the current carrier says freeze. Do not infer equivalence; a separate output-approval contract must settle the mapping.
OUTPUT_ATTEST_DOCUMENT_ASSEMBLY	PublicationAssemblyResult v0.1 with ATTEST_DOCUMENT_ASSEMBLY / ATTESTED	Existing carrier; exact assembly, attestation statement, signature policy, EvidenceEvent, and postconditions are missing.
OUTPUT_FILE_SUBMISSION_ASSEMBLY	PublicationAssemblyResult v0.1 can report FILE_SUBMISSION_ASSEMBLY / FILED	No governed filing-outbox carrier binds exact bytes, destination, and idempotency key. Missing filing-commit contract; transport release remains #13.
SHARE_GRANT_ACCESS	SharingGrant v0.1; the approved authorization design requires a later source-contract v0.2	Domain owner exists, but the protected mapping must wait for the exact v0.2 source schema so it cannot validate against an obsolete mutable-state/free-text carrier.
SHARE_REVOKE_ACCESS	RevocationDecision v0.1 with exact SHARING_GRANT / TERMINATE posture	Existing owner; exact intent/result mapping, immutable affected-grant digest proof, and no-mutation postcondition are missing.
RECEIVE_READ_DATA	Explicit NO_STATE_EFFECT	No protected state-effect contract belongs in #12. Buffered disclosure and receipt evidence remain governed by the authorization design and retention/proof work in #14.

Boundary split

The inventory yields these independently owned groups:

1. observation and evidence-link effects;
2. assertion effects;
3. intervention planning and execution-report effects;
4. final review decisions, with review requests kept separate;
5. pack installation and activation/deactivation effects;
6. output approval, attestation, and filing-outbox effects; and
7. sharing-grant and revocation effects.

Combining these in one PR would cross domain owners and event/commit classifications. The parent issue should remain the inventory and coordination record; each implementation candidate must use a linked child issue and one primary effect-family boundary.

First child boundary

Start with final ReviewDecision effects for REVIEW_ACCEPT, REVIEW_REJECT_OR_CONTEST, and REVIEW_SUPERSEDE only. They share one accepted/current result owner and the existing GovernanceEvent / governance decision classification. The work can expose the minimum ReviewDecision contract delta and exact mapping law without depending on transport, retention, pack semantics, observation subtype selection, or the future authority-source v0.2 schemas.

The first child must remain a non-authoritative Phase A candidate. It must not edit the approved authorization candidate, current schemas, active Event Grammar, currentness, or runtime code. If exact mapping reveals an authorization-law change rather than a domain-result field, that change must stop and return to a separate #10 amendment.

What is next: open the final ReviewDecision protected-effect child issue and develop its one-file Phase A candidate on a branch from main.

[samovers]

Created child #27: Define the sharing-access revocation protected-effect contract.

It covers only SHARE_REVOKE_ACCESS: one new immutable RevocationDecision using TERMINATE for one exact SharingGrant, preserving the grant and history. The primary trust boundary is sharing-revocation domain effect semantics and commit classification.

The first deliverable is a one-file, non-authoritative Phase A candidate. Existing authorization and transaction designs are inputs, not reopened scope. No schema, authorization-rule, runtime, retention, or currentness change is authorized by issue creation. This child records a remaining contract gap; it does not mark that gap or this parent complete.

What is next: inventory the authoritative revocation carrier and classification surfaces, then prepare the bounded Phase A candidate under #27 for review.