Module revocation 

Revocation semantics (SIGNATIF §12).

Four pieces:

• Crl — the signed, time-stamped list of revoked authority credentials with reason, validity period, and a transparency-log reference for its own publication;
• AuthorityStateBinding — the hash-binding that ties an artifact to the authority states under which it was produced;
• RevocationIndex — propagation and query: when a state is revoked, every transitively bound artifact is marked (never deleted), reversibly if the revocation is corrected;
• RevocationView — the offline-verifier lens consumed by the pipeline, including the CRL grace-period policy.

Structs

AuthorityStateBinding

The hash-binding of an artifact to the authority states under which it was produced (hash-binding requirement): the artifact’s canonical payload hash plus the fingerprints of every authority on every verified path.

Crl

A certificate revocation list: signed by the issuing trust authority, timestamped, validity-bounded, log-recorded.

CrlView

A concrete view over a set of CRLs.

NoRevocations

A view with no revocations — for sealed offline bundles with empty CRLs and for tests.

RevocationIndex

The propagation and query index: artifacts ↔ authority states.

RevokedEntry

One entry in a CRL.

Enums

ArtifactMark

Artifact marking: revoked-but-not-deleted, reversible.

RevocationReason

Why a credential was revoked.

RevocationStatus

Revocation status of a signer as seen by the pipeline.

Constants

DEFAULT_GRACE_PERIOD

Default offline CRL grace period before a stale CRL hard-rejects.

Traits

RevocationView

The offline-verifier revocation lens.