Module revocation 

Central addon revocation / kill-switch (P2).

A revocation immediately blocks an addon from running — at three points:

1. install (super::install) — a revoked addon refuses to install,
2. gateway catalog build (crate::core::mcp_catalog::catalog) — a revoked server is dropped from the catalog with a surfaced error (its tools disappear), and
3. every proxy call (crate::core::mcp_catalog) — a call to a revoked server is refused.

This is the platform’s emergency brake: a compromised or malicious addon can be neutralised without waiting for the user to uninstall it. Unlike remove (which the user must run), a revocation takes effect on the next gateway use.

Sources (highest precedence last):

1. the local list <data_dir>/addons/revocations.json, managed by the operator via lean-ctx addon revoke.
2. an org feed layered in through the same signed-override trust anchor as the registry (super::signing) — verified before it can block, so a revocation feed cannot itself be used to disable security tooling. (The network sync that fetches the feed reuses the ctxpkg remote rails; this module is the local enforcement core it feeds.)

Structs

Revocation

A single revocation entry, keyed by addon slug in RevocationList.

RevocationList

The on-disk revocation list (<data_dir>/addons/revocations.json).

Functions

blocked_reason

Runtime block check for a gateway server name: consults the local list and the installed-addon version. Returns the reason when the server must not run.

install_block

Install-time block check: the manifest version is known directly.