pub(crate) fn revocations(api: &str, auth: AuthOptions<'_>) -> RevocationsExpand description
Reads log entries from a cursor and, with --verify, checks them
the way SYNC.md says a client should (D17).
/api/log was the last agent-facing endpoint with no command, and it
is the one where that cost most: the repository ships a 177-line
contract telling clients how to establish that the pages they were
handed really are the chain — continuity, hash recomputation,
authorship — and every step of it was prose. An agent following it
hand-rolled hash-chain and ed25519 checking, and the doc has to warn
about the subtleties it gets wrong.
What --verify establishes, and what it does not. Continuity and
recomputation need nothing but the page: they are fully independent
of the node. Authorship needs the public key, which this command only
has for actors named in --keys; an entry whose key it does not hold
is reported as unverified, never as verified. Saying “checked”
for a signature nobody could check is the one failure that would make
this worse than no command at all.
A passkey entry carries its own credential key (D45), so it needs
nothing from --keys — and is counted separately for the same
reason: the key came with the signature, so the bytes are proven
intact and nothing proves the credential was that channel’s.
This is a first-party client and says so. It decodes into the
same OpEntry the node encodes from, so a hash agreeing here proves
the node agrees with this build’s definition of the format rather
than with an independent reading of SYNC.md.
choir-node/tests/it/sync_contract.rs is the independent one: it
rebuilds the canonical bytes by hand and deliberately never calls
content_hash.
The revocation positions /api/view reports, keyed by actor id.
An empty map on any failure, including a node that cannot be reached or serves no bindings. That is the honest default: it verifies fewer claims rather than more, and the alternative — treating an unanswerable question as “revoked” — would report a sound log as broken.