Record consent withdrawal across private rounds

[maziyarpanahi]

Summary

A site needs to stop future participation and identify affected model lineage without claiming that a contributed aggregate can always be mathematically unlearned.

Scope

• Record opaque withdrawal tombstones that block future use and identify descendant rounds through digest lineage.
• Classify remediation as no-action, retrain, adapter removal, or unsupported with explicit evidence and limitations.

Acceptance criteria

• The implementation is deterministic and performs no mandatory network call.
• Logs, exceptions, reports, and fixtures contain no raw sensitive values.
• .venv/bin/python -m pytest tests/unit/governance/test_consent_withdrawal.py -q

Out of scope

• A compliance certification or autonomous clinical decision guarantee.
• Bundling restricted datasets, credentials, or proprietary services.
• Unrelated changes to release publishing or existing public APIs.

Files

• openmed/governance/consent_withdrawal.py
• tests/unit/governance/test_consent_withdrawal.py
• docs/governance/consent-withdrawal.md

---

Task: OM-173d · Milestone: v3.3 · Priority: P0 · Size: L
Depends on: — · Blocks: —
Roadmap: Audited V3 horizon expansion, 2026-08-13: OPENMED_V3_HORIZON_BRIEF.md sections 3 and 6: federation governance and assurance
Spec: PLANS/V2/EXECUTION/tasks/OM-173d.md