The model
Eight rules and seven words. Everything in the specifications follows from these, and a proposal that breaks one of them is rejected on that ground alone.
The name
A vow that has to be renewed. Nothing in this protocol is permanently true: a licence lapses, a key is lost, a firm closes, an authority suspends someone on a Tuesday. A claim carries a validity window and stops counting when it ends, whether or not anyone noticed. Re-vow, and it counts again.
The eight rules
- The protocol never verifies anyone
It carries claims and evidence about claims. Verification is a judgement, and judgements belong to the party taking the risk, not to a specification.
- No badge. Warn on absence, never decorate presence
A mark of approval gets farmed, and the moment it exists its absence stops meaning anything. Saying that an address is receiving its first payment carries information. A green tick does not.
- Everything decays
Claims expire, attestations expire, evidence goes stale. A consumer displays age, not status. An unrenewed claim fails closed and needs no revocation to do it.
- Revow operates no trust list
Anyone can attest to anything. An attestation is worth exactly what its signer is worth to the party reading it. Publishing a blessed list of attesters would rebuild the gatekeeper this lab exists to route around.
- Public fields only
Trade, jurisdiction, licence reference, legal name, business domain. Never an identity document, a home address, a phone number, a date of birth. If a field would be awkward in a settings page, it does not belong in a claim.
- It has to work at level zero
Every layer above a self-signed claim is optional and additive. A protocol that needs an authority before it does anything is a protocol that does nothing.
- Plain files beat an API that does not exist
A CSV over HTTPS, hashed and signed, is checkable by anybody with a shell. It needs no uptime, no key exchange, no integration, and nobody has to agree to anything first.
- One identity, many addresses
A fresh address per job is normal practice and the protocol must not punish it. Credentials attach to an identity key, which authorises operational addresses with a scope and an expiry.
The seven words
The identity key a professional controls. Everything else in the model hangs off it. It signs rarely and is meant to be kept cold.
A signed document in which the subject states a credential: trade, jurisdiction, authority, licence reference, legal name, domain, validity window. See RVW-1.
Evidence that ties a claim to something outside itself. The DNS record on the business domain is the first one. See RVW-2.
A signed authorisation from the identity key to an operational address, with a scope and an expiry. This is how one professional uses a different address for every job. See RVW-3.
A signed statement by anybody that they checked something and this is what they saw. Carries the weight of its signer and nothing more. See RVW-4.
A file published by the issuing body listing its licences and their status, optionally signed. The strongest evidence in the model and the cheapest thing to ask for. See RVW-5.
How old the newest evidence about a claim is. What a consumer shows instead of a status. See RVW-6.
What a consumer does with all this
A payment page, a marketplace, a directory or a wallet reads a claim, works through the checks in order, and renders the level reached together with the age of the evidence behind it.
It never renders a conclusion. The difference matters: a page saying that the licence on this claim was last seen on the public register nine days ago, by two checkers, tells a reader something they can act on. A page saying verified tells them to stop thinking.
// What a payment page does with a claim, in order.
const c = await fetchClaim(claimId);
if (sha256(canonical(c.document)) !== claimId) return BAD_DIGEST;
if (recover(c.signature) !== c.document.subject) return BAD_SIGNATURE;
if (now >= c.document.expires) return EXPIRED;
if (await revoked(c.document.subject, claimId)) return REVOKED;
const dns = await checkDomainBinding(c.document); // RVW-2
const atts = await collectAttestations(claimId); // RVW-4
// Show the level reached, how old the evidence is, and nothing else.
// Never render a badge. Never render the word verified.What the model deliberately leaves out
No reputation score, no ranking, no aggregate rating of a professional. No identity proofing of a natural person. No revocation authority other than the subject and the issuer. No fee, no token, no registration. Each of these would be easier to build than what is here, and each would make the result something nobody should trust.