01 / The operating case
What changes in a real workflow?
An operator cancels task T while a remote child is queued to restart a server.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Publish monotonically ordered revocation state, track subscriber acknowledgments, invalidate affected cache keys and recheck at the executor; define partition behavior.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A notification is sent but one worker acts from a cached ALLOW before applying it.
Evidence to retain
Measure revoke, delivery, acknowledgement and last enforcement timestamps; preserve in-flight outcomes.
04 / Canonical scope
Why this reference stands alone
Task cancellation triggers withdrawal; this guide owns propagation and freshness.
Illustrative implementation artifact
Revocation freshness timeline
t0: grant G revoked at authority store
t1: invalidation delivered to worker W
t2: W acknowledges cache eviction
t3: next executor check observes revocation epoch
require t3 before any later consequential commitPrimary references