Struct RevocationPolicy 

#[non_exhaustive]
pub struct RevocationPolicy {
    pub known: Vec<KeyRevocation>,
    pub discover: Option<RevocationDiscovery>,
}

Consumer-held key revocations to enforce during verification (ACDP 0.3, RFC-ACDP-0014 §7).

Self::known is pull-based: the pipeline does not go looking for those revocations on its own — the caller supplies the verified revocations it holds (from find_revocations, find_registry_attested_revocations, an out-of-band channel, or its own indefinite cache — the statement is permanent, cache accordingly). Self::discover (RFC-ACDP-0014 §8) is the opt-in complement: when set, verify_retrieved itself runs those same two lookups and unions their result with known (see RevocationDiscovery). When known is empty AND discover is None, the phase is inert and verification behaves exactly as before RFC-ACDP-0014.

When the body’s signing key matches a supplied revocation, §7 applies: a receipt-attested publish time strictly before the (earliest, §4) compromised_since boundary verifies as KeyAuthorization::HistoricallyAuthorizedPreCompromise; at/after the boundary, or with no verified receipt to place the context at all, verification fails closed with key_not_authorized — regardless of DID-document state and regardless of the receipt’s own validity. Note the interaction with ReceiptPolicy::Ignore: an unverified receipt provides no publish time, so a revoked key’s contexts all fail closed under it.

This applies uniformly to every entry point that accepts a VerificationPolicy — VerifiedContext::fetch_with_policy, VerifiedContext::fetch_current_with_policy, and the fetch_report* family (five entry points in total) — since they all reach this phase through the same internal pipeline. On VerifiedContext::fetch_report_diagnose specifically, “fails closed” means the returned VerifiedContext handle is withheld and the cause is recorded in VerificationReport::policy_phase_error, rather than the call returning Err — that method never short-circuits on a policy-phase failure by design.

“Uniformly” has two carve-outs, both structural rather than a policy choice: VerifiedContext::fetch and VerifiedContext::fetch_current hardcode VerificationPolicy::default and so can never carry a non-empty known or a discover; callers wanting either use the _with_policy forms instead. And crate::CrossRegistryResolver builds its own internal policy with no injection point, so neither known nor discover can reach a cross-registry walk at all. Both are recorded as known limitations (issue #248 LIM-1/LIM-2) rather than silently true.

Only put revocations here that you have verified (strict body pipeline + the §5 not-self-signed rule) and, per §6, that you have decided to act on: producer-signed ones unconditionally; registry-attested ones (RevocationTrustClass::RegistryAttested) by default only for contexts served by or receipted by that same registry, with corroboration before global application.

find_revocations itself pre-filters its output to RevocationTrustClass::ProducerSigned entries actually published by the queried producer, so §6 registry-attested attestations never arrive through it — obtain those from find_registry_attested_revocations instead.

#[non_exhaustive]: this struct grew a second field (Self::discover, RFC-ACDP-0014 §8 auto-discovery) after having shipped with exactly one, and a caller constructing this with a bare struct literal would otherwise break on every future field the same way. Construct with Self::new (equivalent to today’s RevocationPolicy { known }) and, when opting into discovery, Self::with_discovery.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

known: Vec<KeyRevocation>

Verified revocations to enforce, matched against the signing key’s RFC-ACDP-0010 §6 fingerprint. The §4 earliest- compromised_since rule is applied across entries naming the same fingerprint, so include every revocation of a lineage, superseded (and retracted) ones too — a later member can only widen the compromise window, never narrow it, and dropping an earlier one is exactly how that window gets quietly (and wrongly) shrunk. This is no longer an unassisted obligation: find_revocations and find_registry_attested_revocations each walk the full lineage of every candidate they find (search-visible or not, including all-retracted lineages) and already return the complete set for their respective trust class; find_revocations_in_lineage does the same directly from a known lineage_id, with no producer/trust-class scope filter. Populate known from one of these rather than hand-assembling a lineage.

discover: Option<RevocationDiscovery>

RFC-ACDP-0014 §8 auto-discovery configuration. None (the default) is exactly today’s behavior: the caller supplies everything via Self::known and this phase does no network I/O of its own. Some opts into running find_revocations and, depending on RevocationDiscovery::include_registry_attested, find_registry_attested_revocations as part of verification, merging their results with Self::known.

Implementations

impl RevocationPolicy

pub fn new(known: Vec<KeyRevocation>) -> Self

Construct a policy from a caller-supplied revocation set with discovery left off (discover: None) — the same shape as the bare RevocationPolicy { known } literal this struct’s #[non_exhaustive] retires.

pub fn with_discovery(self, discovery: RevocationDiscovery) -> Self

Opt into RFC-ACDP-0014 §8 auto-discovery on top of any caller-supplied Self::known revocations. See RevocationDiscovery for cost and the required explicit trust-class choice.

Trait Implementations

impl Clone for RevocationPolicy

fn clone(&self) -> RevocationPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RevocationPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RevocationPolicy

fn default() -> RevocationPolicy

Returns the “default value” for a type.

impl Eq for RevocationPolicy

impl PartialEq for RevocationPolicy

fn eq(&self, other: &RevocationPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for RevocationPolicy