Intent observability: support immutable assessment revisions for late evidence

[dinpd]

Parent: #45
Depends on: #60
Coordinates with: #50, #52
Normative target: #58

Outcome

Preserve the current immutable finalization guarantee while allowing late real-world evidence, evaluator corrections, and adjudication changes to produce a new, auditable assessment revision.

Current gap

AgentPass currently permits previews followed by one immutable final receipt and rejects later evidence. This protects the original result, but it cannot represent delayed provider outcomes, compensation or rollback, corrected evaluators, or later independent adjudication without starting an unrelated intent.

Scope

• monotonic assessment_revision per subject and measurement profile
• a new immutable evidence snapshot/digest for every revised final assessment
• explicit revision reasons such as late evidence, evaluator correction, adjudication update, compensation, or rollback observation
• preservation of superseded final receipts and their original evaluator/evidence bindings
• idempotent revision requests and conflicting-request rejection
• concurrency rules for evidence arrival and assessment finalization
• aggregate selection semantics: latest final revision, revision as-of cutoff, or explicitly selected revision
• audit events and operator views for revision creation and supersession
• compatibility behavior for current single-final V1 receipts

Acceptance criteria

• Late evidence never mutates an existing final snapshot or receipt in place.
• A valid reassessment creates a new revision with a new evidence snapshot/digest and preserves the prior final result.
• Replaying the same revision request is idempotent; conflicting content under the same revision identity is rejected and audited.
• Revision ordering remains deterministic under concurrent late evidence and evaluator requests.
• Aggregates declare whether they use the latest final revision or an explicit assessment cutoff.
• Historical dashboards can reproduce the result that was final at a prior cutoff.
• A reassessment cannot reopen runtime authority, reactivate an expired contract, or authorize another side effect.
• Compensation and rollback can revise outcome and constraint assessments without erasing the original execution evidence.
• Existing V1 final receipts remain readable and map to revision 1 under a documented compatibility rule.

Validation

• delayed success observation after an initial indeterminate result
• delayed failure after an apparent success
• compensation and rollback state change
• evaluator bug correction
• concurrent revision race
• exact revision replay and conflicting revision payload
• latest-versus-as-of aggregate reproduction
• proof that revision does not restore execution authority

Non-goals

• mutating finalized records
• allowing arbitrary deletion of historical assessments
• tying reassessment availability to trace retention