Intent observability: add independent control-effectiveness and friction assessments

[dinpd]

Parent: #45
Depends on: #47, #60
Normative target: #58

Outcome

Measure whether AgentPass correctly enabled or intervened in an action—and the operational friction introduced—using an independently established reference disposition rather than treating the gate's own decision as ground truth.

Current gap

The current implementation reports allow, deny, challenge, execution, retry, and replay activity. It cannot yet classify a decision as correct enablement, correct intervention, unnecessary intervention, or a missed control. It also lacks challenge/approval duration, abandonment, repeated approval, and final-disposition friction measurements.

Scope

• versioned reference-disposition assessment: should_enable, should_intervene, indeterminate, or not_applicable
• observed control disposition: enabled, intervened, not_reached, or unknown
• independently derived classifications: correct_enablement, correct_intervention, unnecessary_intervention, and missed_control
• adjudicator/evaluator identity, version, method, confidence interpretation, evidence snapshot, and reason codes
• deterministic policy replay, independent human review, trusted business-state evidence, incident review, and explicitly declared model-based adjudicators
• challenge count/duration, human-review count/duration, repeated approval requests, abandonment after challenge, scope-drift rejection, and proposal-to-final-disposition latency
• action-, step-, run-, and compatible-cohort rollups with explicit numerators and denominators
• optional impact profiles for stronger counterfactual claims

Acceptance criteria

• All four should-enable/should-intervene × enabled/intervened outcomes are represented and tested.
• The original allow, deny, or challenge decision cannot serve as its own reference disposition.
• Missing, conflicting, or insufficient adjudication remains indeterminate rather than being selected in the control's favor.
• A correct mandatory step-up may record substantial friction without being classified as an unnecessary intervention.
• prevented_harm is not emitted unless a versioned impact profile defines the harm and establishes the counterfactual evidence; otherwise the result is correct_intervention or prevented_disallowed_action.
• Aggregate control metrics publish numerator, denominator, eligible, excluded, and indeterminate counts.
• Final control assessments bind the action subject, measurement profile, evaluator version, reference evidence, and immutable evidence snapshot/digest.
• Tenant isolation and privacy rules prevent direct customer identifiers, action IDs, or unbounded reason strings from becoming metric labels.
• Historical control results cannot automatically expand runtime authority.

Validation

• safe action correctly enabled
• unsafe action correctly intervened
• safe action unnecessarily blocked
• unsafe action allowed
• correct challenge with high friction
• abandoned work after challenge
• independent adjudicators disagree
• missing reference evidence
• attempted self-confirming gate evaluation

Non-goals

• declaring every denial prevented harm
• defining a universal safety policy
• allowing historical quality to grant future authority