Struct RevocationPolicy 

pub struct RevocationPolicy {
    pub known: Vec<KeyRevocation>,
}

Consumer-held key revocations to enforce during verification (ACDP 0.3, RFC-ACDP-0014 §7).

The revocation signal is pull-based: the pipeline does not go looking for revocations on its own — the caller supplies the verified revocations it holds (from find_revocations, find_registry_attested_revocations, an out-of-band channel, or its own indefinite cache — the statement is permanent, cache accordingly). When known is empty the phase is inert and verification behaves exactly as before RFC-ACDP-0014.

When the body’s signing key matches a supplied revocation, §7 applies: a receipt-attested publish time strictly before the (earliest, §4) compromised_since boundary verifies as KeyAuthorization::HistoricallyAuthorizedPreCompromise; at/after the boundary, or with no verified receipt to place the context at all, verification fails closed with key_not_authorized — regardless of DID-document state and regardless of the receipt’s own validity. Note the interaction with ReceiptPolicy::Ignore: an unverified receipt provides no publish time, so a revoked key’s contexts all fail closed under it.

This applies uniformly to every entry point that accepts a VerificationPolicy — VerifiedContext::fetch_with_policy, VerifiedContext::fetch_current_with_policy, and the fetch_report* family — since they all reach this phase through the same internal pipeline. On VerifiedContext::fetch_report_diagnose specifically, “fails closed” means the returned VerifiedContext handle is withheld and the cause is recorded in VerificationReport::policy_phase_error, rather than the call returning Err — that method never short-circuits on a policy-phase failure by design.

Only put revocations here that you have verified (strict body pipeline + the §5 not-self-signed rule) and, per §6, that you have decided to act on: producer-signed ones unconditionally; registry-attested ones (RevocationTrustClass::RegistryAttested) by default only for contexts served by or receipted by that same registry, with corroboration before global application.

find_revocations itself pre-filters its output to RevocationTrustClass::ProducerSigned entries actually published by the queried producer, so §6 registry-attested attestations never arrive through it — obtain those from find_registry_attested_revocations instead.

Fields

known: Vec<KeyRevocation>

Verified revocations to enforce, matched against the signing key’s RFC-ACDP-0010 §6 fingerprint. The §4 earliest- compromised_since rule is applied across entries naming the same fingerprint, so include every revocation of a lineage, superseded (and retracted) ones too — a later member can only widen the compromise window, never narrow it, and dropping an earlier one is exactly how that window gets quietly (and wrongly) shrunk. This is no longer an unassisted obligation: find_revocations and find_registry_attested_revocations each walk the full lineage of every candidate they find (search-visible or not, including all-retracted lineages) and already return the complete set for their respective trust class; find_revocations_in_lineage does the same directly from a known lineage_id, with no producer/trust-class scope filter. Populate known from one of these rather than hand-assembling a lineage.

Trait Implementations

impl Clone for RevocationPolicy

fn clone(&self) -> RevocationPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RevocationPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RevocationPolicy

fn default() -> RevocationPolicy

Returns the “default value” for a type.

impl Eq for RevocationPolicy

impl PartialEq for RevocationPolicy

fn eq(&self, other: &RevocationPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for RevocationPolicy