Module auth_revocation 

Lys grant revocation applied to admission and live rights (ACCESS-005).

Liminal never decides who may revoke: a revocation reaches this module only as an authoritative change on the grant log Lys’s own judge_revoke admitted (the issuer, a holder of an ancestor, or the root authority). This module holds what liminal does with it:

• The binding (R1). A connection admitted under a revocation policy carries a GrantDecisionBinding: the grant log it was decided from, the receipt revision its pass requires, and every bound right with each complete grant chain that allows it. It is built only by verify_binding, from an AuthenticatedBinding the Lys producer seam (GrantBindingSource) authenticated, after its issuer, audience, holder and exact canonical pass digest were compared with the presented credential. No producer is published yet (Lys DIRECTORY-089 R2), so the installed seam is UnpublishedGrantBinding, which refuses revocation_binding_missing by name.
• The consumer (R2). One RevocationAuthority per configured grant log applies the ordered change stream liminal reads from Lys (GrantFeedEvent): a bounded baseline, then every tail revision in order, then Ready. A missing revision is a Gap, a lost transport is Unavailable, a replaced log is Reset, an unknown event is terminal. Nothing here polls, sleeps or retries: the reader that owns the stream hands each event to RevocationAuthority::apply.
• The fence (R3). RevocationAuthority::stage verifies and, outside the guard, acquires any cold decisions; RevocationAuthority::commit is the one ordered transition that checks readiness, log identity, the required revision and the admitting right, and binds the connection into the reverse index. A reply older than a deny never overwrites it.
• Live rights (R4). Applying a revocation visits only the connections the reverse index binds to the revoked grant. A lost right that did not admit the connection is withdrawn (RevocationEffect::Withdraw); the loss of the admitting right closes it (RevocationEffect::Close). Hot checks read the connection’s own ConnectionGrants without the authority’s guard and never ask Lys.
• Cleanup (R6). RevocationAuthority::release is called once from the connection runtime’s single removal funnel; it retires the connection’s index entries and prunes decisions no binding and no in-flight ask needs.
• Diagnostics (R7). RevocationAuthority::diagnostics reports the readiness, cursor, producer high water, gap length (or that it is unknown), transitions and per-phase counts.

The cache and indexes are process memory: nothing here is stored, flushed or synced.

Structs

ApplyOutcome

The result of applying one event.

AuthenticatedBinding

A grant-decision binding the Lys producer seam authenticated (DIRECTORY-089 R2).

AuthorityPoisoned

The revocation authority’s lock was poisoned by a panicking holder; its state is untrusted and is not read.

BoundRightClaim

One right as the producer bound it.

ConnectionGrants

One admitted connection’s binding and its current rights (ACCESS-005 R3, R4).

DecisionReply

One cold decision reply: whether each asked grant is revoked, decided at revision on log.

Digest32

A 32-byte digest or key id, compared exactly, shown by length only.

GrantDecisionBinding

The binding one Connect verification proved, carried privately into the connection. Only verify_binding builds one.

GrantId

A Lys grant id, opaque here. Its Debug names its length only, so no grant-chain bytes reach a log.

GrantLogId

A grant log’s identity and its reset epoch: the revision domain a receipt revision belongs to. Revisions from different identities or epochs never compare.

InvalidGrantInput

A value from the grant stream or the producer that could not be accepted as an identity: empty, or over its bound.

Revision

A receipt revision: GrantReceipt::revision(), the receipt coordinate’s index plus one. Never an event-format version or a timestamp.

RevocationAuthority

One grant log’s revocation consumer, decision cache and admission fence (ACCESS-005 R1-R4, R6, R7).

RevocationCounts

Per-phase counts (ACCESS-005 R7).

RevocationDiagnostics

A bounded snapshot of the consumer (ACCESS-005 R7). It carries no credential, holder, prefix or grant bytes.

RevocationPolicy

What a binding must match to be used here: the configured log, this server’s audience and the issuer key it trusts.

StagedAdmission

A verified binding whose cold decisions are acquired, waiting for the fence. While it lives it holds an in-flight ask, so no deny it could read is pruned; dropping it uncommitted releases that.

Transition

One announced readiness transition.

UnpublishedGrantBinding

The producer seam while Lys publishes none: every credential is refused revocation_binding_missing, never admitted on a guessed binding.

UnpublishedGrantDecisions

The decision seam while Lys’s batch check carries no log identity: every cold ask is refused revocation_revision_unavailable.

Enums

Applied

How an event was taken.

CloseWrite

How a reason-bearing close’s write ended, as the connection observed it. None of these is a claim the peer received it.

GapLength

Whether the consumer knows how many revisions it is missing.

GrantFeedChange

One grant change on the stream.

GrantFeedEvent

One event of the consumer-opened Lys grant-change stream (Lys DIRECTORY-089 R1), as the reader that owns the stream decoded it.

Readiness

The consumer’s readiness (ACCESS-005 R2).

RevocationEffect

What applying an event asks the connection runtime to do.

RevocationRefusal

A revocation decision failure, by its stable public name (ACCESS-005 R5).

RightAction

The action a bound right allows: admission itself, or one hot action.

Constants

EVIDENCE_RETAINED

How many applied revisions keep their evidence digest, so a duplicate can be told from a conflicting one.

MAX_BOUND_RIGHTS

The most rights one binding may carry.

MAX_CHAINS_PER_RIGHT

The most independent grant chains one right may carry.

MAX_CHAIN_LEN

The longest grant chain (leaf to root) one right may carry.

MAX_DECISIONS_PER_EVENT

The most decisions one baseline or one cold reply may carry.

MAX_DIAGNOSTIC_EVENTS

How many readiness transitions the diagnostic ring keeps; an overflow is counted and announced, never silent.

MAX_GRANT_ID_LEN

The longest grant id accepted, in bytes.

MAX_LOG_IDENTITY_LEN

The longest grant-log identity accepted, in bytes.

MAX_RIGHT_PREFIX_LEN

The longest subject prefix one right may carry, in bytes.

Traits

GrantBindingSource

The Lys producer seam (DIRECTORY-089 R2).

GrantDecisionSource

The cold-decision seam: Lys answers whether grants are revoked on an identified log at no earlier than at_least. Asked only outside the authority’s guard, during staging, never on a hot path.

Functions

verify_binding

Verifies the binding for credential, presented by holder, against policy (ACCESS-005 R1).