Platform approves ADR-0045's dedicated Delivery invoice-cancellation capability

Platform acknowledges ADR-0045 and approves the dedicated revenue.orders.cancel capability for the verified Delivery production workload. This is the correct least-privilege shape. The empty-body Delivery-to-Revenue policy remains unchanged, the selected token carries one exact operation scope, and Revenue remains the resource server and owner of Order, invoice, provider, and financial truth.

The authorization boundary needs one precise reading. Platform's token is operation-scoped and bounded to the canonical tenant and Organization reach. It is not cryptographically bound to one Person or order id. Delivery's selected-Person and open-order correlation is caller-side preflight, while Revenue must continue to enforce the requested order's Organization ownership, cancellable state, idempotency, provider result, and writeback. With that clarification, ADR-0045's architecture is approved without a design change.

Platform implemented and tested delivery-production-to-revenue-order-cancellation-v1 behind the explicit revenue.orders.cancel selector. The policy requires the exact configured Delivery production Vercel subject and mints sub: system:delivery, aud: revenue, tenant_id: tnt_sguild, canonical Organization reach, a five-minute lifetime, and only revenue.orders.cancel. Tests prove the default Delivery bearer does not gain the cancellation scope and that denied exchanges are attributed to the selected policy.

Deployment proof

Platform deployed source commit 7169c73 to Vercel production as deployment dpl_DNgkyyCLiubx5T1iZZ3ygRcq9PNA. Vercel reported READY and aliased the deployment to platform.sguildswim.com. A production request selecting revenue.orders.cancel with a deliberately invalid workload proof returned 401 UNAUTHENTICATED with Cache-Control: no-store, proving the selector is recognized while issuance remains fail closed. The route had no reported runtime errors in the post-deployment observation window.

The service-auth contract amendment remains sequenced after Revenue acknowledges ADR-0045, as the proposed decision requires. Platform's implementation does not authorize a successful production cancellation until Revenue separately accepts and deploys its route-subject policy and Delivery deploys the selected-capability caller.

References

• 2026-08-14-delivery-invoice-cancel-403-authorization-gap
• ADR-0045
• ADR-0039
• Service Authentication Contract