A registry that cannot be forged and cannot be ignored is the difference between policy and enforcement.
Status lives in documents signed by multiple governance keys. A single compromised key cannot mark an origin as revoked, or quietly restore one that was suspended. Clients re-check status at use time and treat registry silence beyond 168 hours as UNVERIFIED rather than "probably fine".
- Fetch the revocation URL from the manifest.
- Verify the document signatures against the published governance keys.
- Apply the status: active, under_review, or suspended.
- Record the document in the audit bundle.
See the revoked demo for the full flow, including what a well-behaved client does when a manifest that verified yesterday comes back suspended today.