Add ORC-001 Orphan Cascade Revocation

[safal207]

What changed

Adds ORC-001 — Orphan Cascade Revocation, a framework-neutral executable contract for revoking side-effect authority from already-running parent/child agent trees after an HRC ownership handoff.

This PR is intentionally stacked on #262 HRC-001 and targets agent/handoff-reachability-causality so the review delta stays narrow.

Core separation

authority validity
process liveness
quiescence

Load-bearing boundaries:

• RUNNING != AUTHORIZED
• KILL_REQUESTED != EXITED
• process-group cleanup is not the authorization boundary
• descendants inherit the parent's lane/owner/epoch/root authority binding
• a descendant cannot self-refresh to a newer ownership epoch

Failure mode

After a committed handoff:

A / epoch 4 -> B / epoch 5

an old root, child, or grandchild may still physically be running. ORC-001 requires their next consequential side effect to fail immediately because the inherited authority epoch is stale. Cleanup/quiescence may complete later.

Executable behavior

Reference statuses include:

SIDE_EFFECT_ALLOWED
BLOCKED_LANE_MISMATCH
BLOCKED_PARENT_EXECUTION_MISMATCH
BLOCKED_AUTHORITY_LINEAGE_ESCAPE
BLOCKED_REVOKED_AUTHORITY_EPOCH
BLOCKED_REVOKED_AUTHORITY_OWNER
REVOCATION_PENDING_LIVE_EXECUTIONS
REVOCATION_QUIESCENT

Falsification suite

Adds 16 tests covering:

• current root and child admission;
• stale root revocation after handoff;
• stale child and grandchild revocation while still RUNNING;
• descendant self-refresh / root-identity escape attempts;
• wrong parent binding;
• new owner/new lineage admission;
• KILL_REQUESTED not implying quiescence;
• exited parent + live orphan child remaining non-quiescent;
• all stale descendants observed EXITED -> quiescent;
• unknown process state failing closed;
• owner and lane mismatch boundaries.

Motivation / evidence boundary

The motivating Claude Code #24798 discussion includes a practical recommendation to place each session in its own process group so cascading subagents can be killed cleanly when a session fails. ORC-001 treats that as an important cleanup primitive while testing the stronger safety question: what prevents a stale descendant from producing a side effect before cleanup wins the race?

This PR does not claim that this failure class has been independently reproduced in Claudiverse or Claude Code at a known frequency. It converts the reported operational concern into a falsifiable contract for external testing.

Scope / non-claims

ORC-001 does not claim that process groups are the only valid cleanup mechanism, that a successful kill request proves all descendants exited, that revocation rolls back prior external side effects, or that any vendor has adopted the contract.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 80a40099-6f09-49b6-a6ae-19fed684faee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

External falsification target

The immediate validation target is the multi-session/process-group failure mode reported by @kcarriedo in anthropics/claude-code#24798.

Useful counterexamples for ORC-001:

1. parent exits but a child continues writing stale state;
2. kill/cancel is requested but a descendant survives long enough to emit a side effect;
3. a recovered/replacement session accidentally reuses the old execution lineage;
4. the supervisor architecture makes the entire class impossible because every side effect is already mediated by a stronger authority gate.

Case (4) is explicitly a successful falsification/narrowing result, not a failure to validate.

Current executable baseline: HRC + ORC conformance 40/40 PASS on PR #263 (24 HRC + 16 ORC).

Evidence boundary: this proves internal consistency of the reference contract only. It does not claim that Claudiverse, Claude Code, or another runtime reproduces the orphan-cascade class at a known frequency.