fix(data-integrity): reject invalid artifact revocation replay

[seonghobae]

Objective

Keep durable artifact-link revocation fail-closed across restart. The append-only ledger currently accepts a persisted REVOKED transition with no revocation timestamp, which reconstructs a record that is not considered revoked, and it accepts a second persisted revocation that can rewrite already-terminal revocation metadata.

Test-first state

This stacked Draft starts intentionally RED at exact test-only head 20b84bfd27d56a303122a9b43f07650c63b76c4f, based on #400 exact head 56cd5a261c9e3ab6c8ce81bbe708e2c6552a869f. ArtifactLinkLedgerRevocationReplayTest requires replay to reject both a REVOKED record whose timestamp is absent and a second revocation transition for an already-revoked token. The current replay path accepts both, so the focused assertions are expected to fail.

Scope and dependency

This child is deliberately stacked on #400, which is itself stacked on #357's durable-ledger ordering/integrity work. The slice changes only revocation replay invariants plus focused regression evidence. It does not alter live revocation authorization, tenant lookup, token signatures, artifact delivery, read-status validation, or persistence technology.

Acceptance

Observe exact-head RED -> smallest replay-transition validation -> exact-head mvn -B --no-transfer-progress verify with zero failures/errors/skips, exact owned-production coverage and warning-free public Javadocs -> emitted CI/fuzz evidence. Keep Draft while #400/#357 remain open. After ancestors integrate, reconcile this unique delta onto the live protected base and regenerate all base-sensitive checks/reviews. Independent non-author approval remains a separate protected-merge gate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ebd2a972-a2eb-4463-be97-8e244cef6654

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by clean current-stack reconstruction #449. #449 is based on exact current status parent #448 head 9c9edb212260e0ea6f1de89eb2b3b4e3c2a5722b, begins with test-only RED commit f0e854c444ecdecb4373ec81c0bec3a32f83893d, and restores this PR's two-file revocation replay invariants without importing obsolete #400/#357 ancestry. Exact GREEN candidate head is 17fcbbe59267397c49fac208e2611130936eecb9; child checks are being regenerated. Closing this stale stacked PR prevents ambiguous parent lineage and duplicate review. No predecessor check or approval evidence transfers.