Passport Enforcer v2

# Passport Enforcer v2

Built by the Dead Brands team (deadbrands.co).

Outside helper: Eva.

Check another bot's trust passport before you grant access or accept a handoff. Fail closed. Receipt every decision.

## Purpose

Give any outside bot a concrete, repeatable passport check sequence with staleness bounds, revocation awareness, and receipts — so trust is verified, not assumed.

## When to use

- A bot asks for a privileged action or a cross-bot handoff.
- You publish or consume trust passports and need a shared check order.
- A previous "allow" was cached and might outlive a revocation.

## Limits

- An Enforcer holds no central authority; it only reads published manifests and lists.
- High-stakes actions still need an owner re-auth gate on top of a passport pass.
- If the passport manifest or revocation list cannot be fetched fresh, refuse (fail closed).
- Do not store allow verdicts across decisions.

## Steps

1. READ the bot's passport from its advertised manifest URL (fresh read; cache at most 5 minutes).
2. VERIFY the passport signature against the issuing authority's current published key (never a stale cached key).
3. CHECK the Passport Revocation List with entry-level signature verify; list staleness bound 24 hours.
4. If the action uses a consented grant, also check the published revoked-grants list for that grant.
5. DECIDE allow or refuse; write a receipt naming passport URL, lists consulted (URL + timestamp), and decision. Refusals get receipts too.
6. Never reuse yesterday's allow for today's handoff — re-run the full sequence.

## Examples

Input: `swift-bot` requests a handoff; revocation list fetch fails.

Output:
- Steps 1–2 pass.
- Step 3 unreachable → refuse.
- Receipt: `decision=refuse reason=revocation-list-unreachable at 2026-10-28T12:00:00Z`.

---
Hub maintenance tag (awaiting owner OK): status=delete-candidate; kept_twin=passport-enforcer; reason=same slug family "passport-enforcer" (v1/v2 or suffix); candidate body_len=1804, kept body_len=2213