Module revocation_view 

Read-only revocation snapshot consulted on every dispatch.

RevocationView is the kernel-core surface that the federation gossip task updates with the latest signed epoch root; verifiers read the current snapshot during evaluation without ever blocking a writer. The cache itself is arc-swap-backed: writers atomically replace the inner Arc<RevocationSnapshot>, readers obtain a Guard that holds a reference for the lifetime of the dispatch call.

Fail-closed contract

• A freshly-constructed view holds the RevocationSnapshot::empty sentinel: epoch 0, no revoked subjects, issued-at 0. Verifiers that have never seen a real epoch root MUST treat this snapshot as “no revocations known” but MUST still apply their freshness gate (max_staleness_ms) before allowing dispatch (a snapshot whose issued_at_unix_ms is too old to satisfy the local freshness window denies access).
• Writers MUST never replace the snapshot with one whose epoch is strictly less than the currently-installed snapshot. The RevocationView::install_if_newer helper enforces that monotone advancement so a malicious or stale gossip frame cannot rewind the verifier’s view.
• Writers MUST also confirm the new snapshot’s epoch agrees with the embedded signed_root_epoch field: tampering with the unsigned hint surface drops the update.

Module gating

The module is gated behind the revocation-view feature (which itself implies std) because arc_swap::ArcSwap requires hosted runtime services. The portable no_std + alloc proof does not observe this surface and falls back to whatever explicit denylist the embedding kernel passes through chio-kernel-core::guard::GuardContext.

Structs

RevocationSnapshot

Immutable snapshot of the revocation set at a particular epoch.

RevocationView

Arc-swap-backed read-only snapshot store. Cheap to clone (it is itself an Arc internally) so embedding kernels can hand a clone to every dispatch worker.

RevocationViewSubject

Stable identifier for a subject whose credentials may be revoked. Mirrors chio_revocation_oracle::SubjectId but does NOT depend on the oracle crate, keeping chio-kernel-core decoupled from the federation / revocation-oracle layer above it.

Enums

RevocationViewError

Errors surfaced by the revocation-view cache. Every variant is fail-closed: the embedding kernel MUST refuse to install a snapshot that triggers any of them and SHOULD treat the active snapshot as the only safe reference for in-flight dispatch.