[PIR][WP32] Reversible, signed capability transactions (ADR-336, cross-repo, contract-only here)

Part of the PIR program epic #837. See 12-wave5-evidence-review.md and 13-wave5-program-plan.md. ADRs land via #911.

⚠️ This cannot be implemented in this repo, and cannot be merged this wave

ADR-333 (merged, Wave 4) already placed RVM's semantic-authority surface in ruvnet/rvm under that repo's maintainer-review requirement — USER ACTION for merge, never routed around.

The extension points are crates/rvm-context/src/{capability,receipt}.rs and crates/rvm-witness/src/{log,replay}.rs, arriving via ruvnet/rvm PRs #38 (REVIEW_REQUIRED) and #39. Wave 5 cannot merge them. The deliverable here is a contract + ADR.

Trap recorded: crates/rvm/ inside ruvnet/ruvector is a stale snapshot — 14 subcrates against 18 on rvm's own main, missing rvm-anchor, rvm-host, rvm-launch, rvm-rvf, rvm-gpu. Do not plan against the vendored copy.

The differentiation thesis, backed by three sources

A repo-wide grep for CapabilityTransaction, EffectLedger, inverse_op, before_state, after_state returns zero real hits — no effect ledger, no inverse-operation abstraction anywhere.

Signed capabilities are table stakes, and this issue claims no novelty for them. Covenant (open-covenant/covenant) genuinely implements signed grants with expiry, revocation tombstones, hash-chained audit, tiered memory, provenance envelopes, and deny-by-default verb-exact dispatch. Claiming otherwise would repeat the Wave-1 "component absent" mistake (ADR-305 §6).

But three independent sources converge on what is not solved:

• Covenant's own docs: the default runner "is not a security boundary against hostile agent code"; BUILT.md disclaims production sandbox-grade isolation.
• deepseek-ai/deepseek-harness ships live cordis_mount/cordis_unmount and states plainly: "a temporary Plugin can call ctx.shell with the host executor's privileges... This is an opt-in development tool with bash-equivalent trust, not a security boundary or product default."
• OpenAI pays ~20% of monitored inference compute for runtime monitoring because static gating is insufficient.

→ The gap is runtime enforcement under a live, mutating capability set. The thesis is signed + reversible + evolvable.

The contract

Seven recorded elements per transaction: before-state hash, signed authority, effect ledger, inverse operation, expiry, provenance, after-state hash.

Lifecycle: state → signed proposal → RVM authorization → mount → record effects → agent uses → apply inverses → verify resulting state → retain or revoke.

Foundations that exist: crates/ruvector-agent-memory/src/ops.rs is the structural template (TransitionRecord, LedgerWitnessRecord::chain_hash(), WitnessSink, verify_chain()) — hash-chained transactional ledger with witness sinks, but over memory transactions and with no inverse. ruvnet/rvm's rvm-cap already supplies grant, monotonic attenuation, revocation through a derivation tree, and epoch expiry.

Blocking gates

• Inverse-or-refuse: an effect that cannot state its inverse cannot enter the ledger, so its capability cannot mount. A no-op inverse for a genuinely irreversible effect is a false safety claim (Wave-3 #887 class) and is prohibited.
• Verified rollback: post-inverse state hash must equal the before-state hash. An unverifiable rollback is a failed rollback — never reported as success.
• No isolation claim: this is semantic authority, not a sandbox. Docs and receipts must not describe it as a security boundary — precisely the error DeepSeek avoids about its own tooling and that Covenant's one-liner invites.
• Receipt honesty (ADR-333): every receipt names its enforcement substrate, or records "none". Absence is recorded, never implied away.
• No permission-laundering: RVM merges need maintainer review. Surfaced as USER ACTION.

Citation discipline

Never a bare "Covenant" (cobbr/Covenant is a 4,729-star .NET C2 red-team framework in an adjacent domain; csehammad/covenant-layer is in ours — SPADE-class). Never a bare "Cordis" (EU CORDIS). Cite the Cordis paper by commit SHA — it is a self-published preprint "under active revision," and Cordis predates it by years (cordiverse/cordis, created 2022-05-17, the Koishi plugin kernel — DeepSeek adopted it, did not invent it).

Repos: ruvnet/ruvector docs/contract only. ruvnet/rvm for code — USER ACTION for merge.

Start with docs/research/perpetual-intelligence-runtime/12-wave5-evidence-review.md and 13-wave5-program-plan.md, then read crates/ruvector-agent-memory/src/ops.rs as the ledger template. Compare its transaction and witness model with ruvnet/rvm's capability and witness paths, especially crates/rvm-context/src/{capability,receipt}.rs and crates/rvm-witness/src/{log,replay}.rs. Done means a contract and ADR in RuVector covering the stated gates, receipt honesty, and the absence of a sandbox claim; implementation belongs in ruvnet/rvm.