feat(sensitive): revoke authoritative handle use state

[seonghobae]

Partial implementation of #10.

Buyer/security gap

The stacked prerequisite #46 makes use counts authoritative inside SensitiveHandleUseState, but issue #10 also requires handle revocation on task completion, policy change, key rotation, session termination, or suspicious use. Without authoritative revocation state, a still-unexpired handle with remaining uses can continue to reserve disclosures after the broker has determined it must be withdrawn.

TDD evidence

This draft is stacked on exact #46 head 5f212cdfbf3c453472069973138fd9563cf7bff8.

RED was established at exact test-only head 219bfdc95facadfe034a371badc14326e169c627: repository contracts and rustfmt passed, then cargo check --locked --workspace --all-targets failed because the public production boundary did not yet provide HandleRevocationReason, SensitiveHandleUseState::revoke, SensitiveHandleUseState::revocation_reason, or HandleUseDecision::Revoked.

Current exact head 86ce4bc1c11c270dc532593d673c42bd6f623d74 now provides:

• typed revocation causes for task completion, policy change, key rotation, session termination, and suspicious use;
• first-revocation-wins/idempotent transition semantics;
• authoritative Revoked denial before future use reservation;
• no use-count consumption after revocation;
• preservation of the original revocation reason after duplicate revoke attempts; and
• beginner-readable rustdoc plus changelog evidence that does not claim a durable broker.

Exact-head CI is GREEN: repository contracts, rustfmt, locked workspace check, full tests, strict Clippy, rustdoc, and exact production function/line/region/branch coverage all pass. CodeRabbit commit status is also successful. No inline review threads are currently open.

Scope boundary

This remains an in-process policy-state primitive. It adds no opaque token storage, protected value storage/resolution, database persistence, cross-process transactionality, encryption/KMS, model disclosure, browser fill, workflow mutation, or release claim.

Keep Draft while prerequisite #46 remains active. Canonical whole-product documentation remains owned by PR #44 and this active PR must not be described as protected-main shipped truth.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 684e2ccd-4ccd-4656-b218-26807ca9d5c7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}