Revoke
What “Revoke” is and isn’t
Revoke is a signed correction to the record. An attestor, registry, or platform key authority declares that a previously counted attestation (or mirror) is no longer valid as submitted. Revocation never rewinds history and never moves money; it pauses only what depends on the bad fact, shows the fix path, and resumes when the dossier is clean. Already-paid slices stay paid unless there’s proven fraud and a contractual set-off applies. Rule remains: No proof, no release. No EMT, no funds.
Who can revoke and what they revoke
Revocation comes from the same trust surface that created the fact: the original attestor (PSI/QA, terminal/carrier, DC/3PL, sensor OEM), an external registry/brand feed (for tokens/wrappers), or the platform (key compromise/suspension). The signal is a signed message bound to the PoV hash and the specific attestation/mirror. Each revocation carries: role id, key id, PoV hash, reason code, timestamp, and signature. The Attestor Registry verifies authority and status.
Inspector / PSI: Withdraws a report or corrects a lot/COA.
Terminal / carrier: Amends BL, container list, seal photo/number.
DC / 3PL: Updates receipt/QA.
Sensor OEM: Corrects a temperature stream.
Registry / brand: Flips a token/mirror status.
Platform: Revokes a key or suspends a role (compromise, policy breach).
What happens on-chain
Accept & scope: The contract verifies the signer and that the revoked attestation was counted at a gate. It computes scope: the affected stage (and only downstream releases that depend on it).
Freeze narrowly: For Trade, only future, unreleased slices for the impacted sub-lots are paused. For Tokens, the listing freezes (settled/retired units get a corrective path, not “unretire”).
Open case: A Dispute Pack is assembled: gate checklist, original files + hashes, revocation notice, timestamps, and a proposed fix (re-inspection, corrected doc, variance, replacement).
Resume on fix: When the dossier is clean, a corrective EMT or a replacement token finalizes (with replaces: old_claim_id), and dependent slices resume.
No money flips, no fee posts, no burn occurs at Revoke. Burns on already-paid events remain immutable on the ledger.
Business effects you’ll actually feel
Trade: The timeline shows a red banner on the affected gate with a plain reason (“PSI withdrawn,” “seal mismatch vs packing report,” “temp out of range segment 2”). Only the next money moments pause; what you already paid stays paid. You apply the fix (upload corrected BL + seal photo; schedule re-inspection; apply variance math); the platform mints the corrective EMT and the next release proceeds.
Tokens: Listings freeze; you cannot trade or retire until the mirror/dossier is corrected. If a unit was already retired and the registry corrects it later, EDMA records a compensating action (replacement/compensating retirement) and links both entries. Your original receipt stays—append-only lineage shows the correction.
Inputs, checks, and failure cases
Inputs: pov_hash, attestation_id|mirror_ref, reason_code, signed_by(role_key), order|listing id, optional sub_lot.
Checks: Signer is an active key for the correct role in the Attestor Registry (or an authorized registry/brand/platform key). The attestation/mirror was counted (or is currently freezable). Revocation is idempotent (no double-revoke against the same attestation id). Window/policy (if configured) is respected.
Typical errors: E_NOT_AUTHORIZED—signer/key not allowed for this schema. E_NOT_COUNTED—the referenced attestation didn’t affect a pass. E_ALREADY_REVOKED—processed earlier. E_POLICY_WINDOW_CLOSED—outside governed window (if enabled).
Clearing a revocation
Correct the file: Upload an amended BL (matching container IDs, seal photo/number), corrected PSI/COA, or updated DC QA.
Re-inspect: Schedule a second PSI; the corrective EMT mints on pass.
Variance: Apply MPA math (short-shipment, damage, shelf-life) and release the adjusted slice with a reason line.
Replacement: Bind the same Locked EDSD to a replacement sub-lot; finalize with a new EMT linked via replaces: old_claim_id.
Cancel & refund: If no fix exists, the frozen Locked EDSD returns to the buyer per MPA; downstream slices re-balance.
All fixes are append-only; the proof page shows the original and the corrective entry.
API & Webhooks
POST /v1/pov/revoke: Submit revocation (signed; role key).
GET /v1/pov/revocations/{id}: Scope and status.
POST /v1/trade/replace: Submit corrective dossier—mint corrective EMT (replaces: old_claim_id).
POST /v1/tokens/replace: Mint replacement token/mirror and link lineage.
Webhooks: pov.attestation.revoked—accepted; scope and reason. trade.slice.frozen / trade.slice.unfrozen—pause/resume with case id. tokens.listing.frozen / tokens.listing.unfrozen—token side. oneclaim.replaced—corrective claim finalized; lineage updated.
Fees, burns, and EDSD
No protocol fee, no burn at revocation. Locked EDSD remains locked for frozen slices; Unlocked EDSD from earlier stages can still pay in-platform invoices; off-platform cash-out remains tied to schedule completion, as usual. When the corrective EMT/token finalizes and a release occurs, the normal fee/burn rules apply (Trade 0.5%/milestone with caps; Tokens 4%), and the 50% burn in EDM posts with its hash.
Governance knobs
EDM holders can tune policy, not settlement law: Who may revoke per schema (role lists), propagation SLA (how fast freezes apply), approved neutrals for re-inspection, and penalty bands/rotation for repeatedly bad performance. They cannot allow releases without a clean pass, weaken One-Claim, skip must-fund before shipping, or discount the 50% burn.
Operator checklist
Treat the revocation banner as an actionable task, not an alarm: Open the case, read the reason, pick fix / re-inspect / variance / replace.
Expect narrow impact: Only the dependent future slices pause; other lots and suppliers keep moving.
Don’t plan off-platform cash-out until your schedule completes: Unlocked EDSD can still pay EDMA invoices in the meantime.
File the corrective receipt: The proof page will show original + correction for audit.
Plain recap
Last updated