Vord

Specification

Vord status list — v0

Status: DRAFT — v0, unstable. Normative language (RFC 2119), no v0 stability promise; stamped stable under the same rule as the token spec. The list follows the IETF Token Status List direction where it can and departs only where the ADRs require it (the freshness counter and the key-revocation section).

The status list is the signed, edge-cached revocation projection (ADR-0005) with the freshness and replay discipline of ADR-0032 and ADR-0043.

1. Container

A status list is a JOSE JWT in compact serialization, signed by the realm's distribution key (ADR-0043) — never a token-signing key. Header rules (alg, kid required, per-kid binding) are those of the token spec §2.

2. Claims

Claim Requirement
iss REQUIRED. The realm's issuer URL; one list (set) per realm (ADR-0023).
iat REQUIRED. Publication time; input to the max-age check.
ctr REQUIRED. The monotonic publication counter, scoped to this list (ADR-0032).
vfmt REQUIRED. The list-format version, 0 in v0. Unknown versions MUST be rejected.
bits REQUIRED. The compressed per-token status bitstring; a token's status claim names its index.
revoked_kids REQUIRED (MAY be empty). The key-revocation set: every kid revoked wholesale (ADR-0036).
revoked_sids REQUIRED (MAY be empty). Session-scoped revocation: every sid whose tokens are dead (ADR-0044).

3. Verifier obligations (normative)

  1. Verify the signature against the distribution key material; the list MUST NOT be trusted on transport security alone.
  2. Reject a list older than the configured max-age (iat + max-age vs the trusted clock ± skew); a verifier that cannot refresh within max-age MUST fail closed for affected tokens (ADR-0032).
  3. Enforce monotonicity: reject ctr older than the last accepted value for this list; an equal ctr is the same list and MUST be accepted. The high-water mark (ctr, iat) MUST be persisted locally across restarts; a verifier without its mark treats its cache as cold (ADR-0010 §4, ADR-0032 decision 4).
  4. A token MUST be rejected if its status index bit is set, its kid is in revoked_kids, or its sid is in revoked_sids.

4. Token linkage

The token's status claim (token spec §3.2) carries the list URI and the token's index. In v0 an issuer maintains one active list per realm; partitioning a realm across multiple lists is a v-next concern the URI indirection already permits.

5. Conformance

Vectors under conformance/: accept-vectors (fresh list, equal-counter refetch) and reject-vectors (stale list, regressed counter, revoked index / kid / sid, wrong signing key). They land with the reference implementation.