Delivery traces the invoice cancel 403 to the workload policy and requests ADR-0045 approval

Production symptom

On 2026-08-14, the Delivery Workbench displayed a Revenue-owned open invoice order for a selected customer, then returned Revenue cancel invoice returned 403 when the operator chose Cancel order. The preceding Revenue read succeeded and showed the exact order as open for the selected Person. The failed boundary is the subsequent POST /api/order-externals/cancel-invoice command.

Delivery did not mutate the invoice or attempt a direct provider repair.

Root cause

The 403 matches the current authorization configuration exactly:

1. The service-auth contract's Delivery production policy omits revenue.orders.cancel.
2. Platform's Delivery workload exchange mints that exact default scope set, so Delivery cannot present the cancel scope.
3. Revenue's orders.cancel route policy requires revenue.orders.cancel and allows only the sales subject.
4. Delivery reuses its default Revenue bearer for cancellation, so Revenue correctly denies the request.

This is not an order-state inference or a provider failure. Revenue had already reported the exact order as open. It is also not repaired by adding the scope in Delivery alone, because Platform would not mint it and Revenue would still reject sub: system:delivery.

Proposed boundary

Delivery filed ADR-0045 proposing a dedicated revenue.orders.cancel workload capability for system:delivery. The selected token carries only that scope. Revenue remains the Order, invoice, provider, and financial-truth owner and retains all existing resource, state, idempotency, and writeback checks. Delivery retains its operator-session check and its exact Person plus open-order preflight, then refreshes Revenue's projection after success.

The broad default Delivery Revenue token remains unchanged.

Asks

Platform, please review and acknowledge ADR-0045's dedicated capability and exact mint policy. If accepted, amend the service-auth contract and implement the selector. Please declare Platform's implementation commitment in the reply memo.

Revenue, please review and acknowledge ADR-0045's addition of system:delivery to the existing orders.cancel operation under the exact dedicated scope. If accepted, implement the subject policy and retain the existing audit and state enforcement. Please declare Revenue's implementation commitment in the reply memo.

After both positions are filed, Delivery will implement the selected-capability caller and run a controlled production cancellation proof. Until then, the current 403 is the correct fail-closed result and no invoice data should be manually changed to bypass it.

References

• adrs/ADR-0045-delivery-invoice-order-cancellation-authority.md
• contracts/service-auth/README.md sections 4.3 and 4.6
• Delivery lib/revenue/service-auth.ts
• Delivery lib/revenue/reservation-client.ts
• Revenue lib/auth/platform-jwt.ts
• Platform modules/service-auth/workload.ts