Revocation and freshness
Why everything expires
A credential system that assumes it will hear about a suspension is a credential system that will be wrong for months at a time. Revow assumes the opposite: nobody will be told anything, so a claim that is not actively renewed must stop counting on its own.
Twelve months is the cap on a claim window and short windows are encouraged. A six month claim renewed twice a year costs the subject two signatures and removes an entire class of silent failure.
The four decay signals
| Signal | Cause | Effect on a consumer |
|---|---|---|
| Expired | The window ended. | The claim stops counting entirely. No evidence on top of it counts either. |
| Withdrawn | The subject signed a revocation. | Same as expired, from the moment it is seen. |
| Contradicted | An attestation reports mismatch or not-found against the register or an authority file. | The level drops to what the remaining evidence supports, and the contradiction is shown. |
| Stale | The newest attestation is older than the consumer threshold. | The level holds but the age is shown. Never silently treated as current. |
Withdrawal
{
"rvw": 6,
"action": "revoke",
"claim": "fba0fc855026ba9758a1bbb2a41b3a4a5ebe54be5aca29b07c034d5c0e04ae10",
"subject": "0xa805a67f59cccc9869d5dcb4ffc02fc697b5819d",
"reason": "key-rotated",
"at": "2026-11-20T11:02:00Z"
}Signed by the subject. Reasons are free text; key-rotated, licence-ended and error are the conventional ones. Only the subject and the issuing authority can withdraw a claim. Nobody else, including the lab, can.
Doing it faster, onchain
Expiry and withdrawal both work with no chain at all, by publishing documents. A chain buys two things and only two: a timestamp nobody can move, and a withdrawal that propagates in seconds rather than at the next fetch. For a payment about to happen, the second one matters.
That is the whole of RVW-7, which carries the interface, the source and the deployment. It is optional throughout: a consumer that cannot reach a chain falls back to published documents and says in the interface that it did.
Display rules
Age is rendered in words a reader can act on, and absence is rendered more loudly than presence. The reference wording is on the levels page. Three things a consumer must never do: show a tick, show a score, or render a failed lookup as a negative finding about the subject.
Limits
Short windows push work onto the professional, which is the main reason credential systems rot. Onchain withdrawal is immediate but public and costs gas, which makes it unattractive for exactly the routine rotation it would serve best. Latency is open problem OP-7.