Revocation & PoV Feed (Flags, Rectify, SLA)

Summary: In PoV, revocation is first-class. If a counted verification is revoked or expires and quorum drops, dependent assets are flagged / frozen / burned per policy until rectified. The PoV Feed posts on-chain flags within the < 24h SLA. Fixes are append-only—history is never rewritten

When revocation triggers

• Attestor revocation of a counted Verification.v1 (reason: fraud, data mismatch, clerical, superseded)

• Role disable / de-list in PoVAttestorRegistry for a counted verifier

• TTL expiry (validUntil) on any counted verification

• Policy breach detected by monitors (for example, overlapping meter windows, replay, method invalidation)

Invariant: if the remaining set no longer meets QuorumSpec (minTotal, minDistinctRoles, includes AUDITOR), the asset must leave the Active state.

States and policy

• Active — quorum valid; transfers and settlement allowed

• Flagged — visible warning; transfers/settlement may be restricted by policy

• Frozen — transfers and settlement blocked until rectified

• Burned — hard revoke (irreversible; reserved for fraud / unrectifiable cases)

• Rectified — quorum restored via fresh verifications for the same evidenceHash

Default policy (v0.1): drop to Frozen on quorum loss; escalate to Burned only via explicit governance action or confirmed fraud.

PoV Feed (what it does)

• Subscribe to EAS revocation/expiry and Registry role-change events

• Resolve impact for affected claimId sets and dependent assets

• Flag on-chain by calling flagRevoked(claimId) on asset/policy contracts

• Notify integrators and explorers (webhooks, email, on-chain events)

SLA: < 24 hours from revocation / role disable / expiry to on-chain flag. Critical tranches may use tighter windows (for example, < 2 hours).

Events and hooks to implement

Every affected asset (Energy NFT, Carbon Credit NFT, EMT, wrappers) MUST implement:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

interface IPoVFlaggable {
    event PoVFlagged(bytes32 indexed claimId);
    event PoVRectified(bytes32 indexed claimId);

    function flagRevoked(bytes32 claimId) external;   // only PoV Feed / Policy
    function rectify(bytes32 claimId) external;       // only Governance / Policy
    function isFrozen(bytes32 claimId) external view returns (bool);
}

Behavior:

• flagRevoked: set state to Flagged/Frozen; block transfers and settlement tied to that claimId; emit PoVFlagged

• rectify: confirm new verifications restore quorum for the same evidenceHash; clear freeze; emit PoVRectified

• Storage is append-only; never delete prior events

Minimal asset pattern

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

abstract contract PoVFlaggable {
    mapping(bytes32 => bool) private _frozen;

    event PoVFlagged(bytes32 indexed claimId);
    event PoVRectified(bytes32 indexed claimId);

    function isFrozen(bytes32 claimId) public view returns (bool) { return _frozen[claimId]; }

    function _flag(bytes32 claimId) internal {
        _frozen[claimId] = true;
        emit PoVFlagged(claimId);
    }

    function _rectify(bytes32 claimId) internal {
        _frozen[claimId] = false;
        emit PoVRectified(claimId);
    }

    modifier notFrozen(bytes32 claimId) {
        require(!_frozen[claimId], "POV_FROZEN");
        _;
    }
}

// Example: block transfer if underlying claimId is frozen
function _beforeTokenTransfer(address from, address to, uint256 tokenId, bytes memory /*data*/) internal virtual {
    bytes32 claimId = _claimOf(tokenId); // implement mapping tokenId -> claimId
    require(!isFrozen(claimId), "POV_FROZEN");
}

Circuit breakers

Use a lightweight circuit breaker in settlement and gate paths to pause on systemic issues; resume via timelocked governance.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

abstract contract CircuitBreaker {
    bool public paused;
    event Paused();
    event Unpaused();

    modifier notPaused() { require(!paused, "PAUSED"); _; }

    function _pause() internal { paused = true; emit Paused(); }
    function _unpause() internal { paused = false; emit Unpaused(); }
}

Rectification workflow (operator view)

1. Detect — PoV Feed observes revocation / expiry / role change

2. Flag — Feed posts flagRevoked(claimId) on affected assets (< 24h SLA)

3. Investigate — issuer and attestors analyze cause (data mismatch, clerical error, fraud)

4. Re-verify — new Verification.v1 attestations restore quorum for the same evidenceHash

5. Rectify — governance/policy calls rectify(claimId); asset unfrozen; PoVRectified emitted

6. Post-mortem — publish incident report; update registry/methods if needed

Fraud outcome: confirmed fraud may lead to burn of affected assets and de-listing of the attestor (public notice).

What the PoV Feed watches

• EAS: revoked / expired Verification.v1 (and meter batch revokes if applicable)

• Registry: role disables, de-lists, quorum parameter changes

• Policy: methodHash invalidations, device certificate revocations, overlapping windows

Explorer and transparency

• Show PoVFlagged and PoVRectified by claimId and by token

• Badge state: Active / Flagged / Frozen / Burned with timestamps and reasons

• Link to attestation UIDs and revocation reason codes

Settlement policy reminder

• Proof mints and conversions are gas-only on Base; flags do not charge users

• Settlement requires EDM; fees enforced on-chain: Energy/Carbon 4% total, Commodity 0.5% per milestone with caps; 50% burned

• If Flagged/Frozen, settlement reverts until rectified

Integrator checklist

• Implement flagRevoked and rectify; block transfers/settlement when Frozen

• Subscribe to the PoV Feed; surface state in UI; store claimId ↔ token mappings

• Respect CircuitBreaker signals in mint/settle flows

• Publish incident responses and rectifications for audit trails

Bottom line: Integrity is enforced in production: revocation is cheap and binding, rectification is controlled and auditable, and users always see the current truth on-chain.