feat(spec): Trust Anchor Model (§3.4) + Revocation Propagation (§8.7) - closes #1

[chrishooooo-netizen]

Summary

Closes #1 (Federation + Trust Anchor). This PR turns the Federation discussion into an implementable, normative spec section and closes the cross-registry revocation gap that has blocked verifier conformance.

Built on the technical memo from Amey Parle (2026-04-13) — co-architected with Amey. Amey's positioning paper reframed Issue #1 from "discussion" to "PRD", and this PR is the direct materialization of his recommendations.

What changed

New §3.4 — Trust Anchor Model (normative)

Federated hybrid trust model with three explicit tiers:

• Tier-1 Root Registries — TSAI + curated operators, mutual recognition via §3.3 federation. Initial Tier-1 set to be finalized in the Genesis Issuer Set (v1.2.0-rc1). No single root is privileged.
• Tier-2 Sub-Registries — Delegate from one or more Tier-1 roots. CA-like structure without a single trust anchor. Cross-signing supported.
• Tier-3 Endpoint Endorsements — Web-of-trust overlay. Endorsements count in §7.3 D5 but are discounted via a Risk Penalty to prevent cluster attacks. Tier-3 entities cannot publish authoritative Status Lists.
• Verifier Trust List — Verifiers select their active anchor set locally. No hard-coded single anchor. Closes the "MAY operate as a standalone registry" loophole previously in §3.3.

§3.3.3 — Federation Requirements hardened

Registry discovery and cross-registry referrals are now MUST-level. Every conforming registry must declare which §3.4 tier it operates in.

New §8.7 — Revocation Propagation Protocol (normative)

• Authoritative Registry uniqueness — Exactly one per DID via the TrailRegistryService endpoint declared in the DID Document (§3.3.1 item 1). Conflicting claims = spec violation.
• Status List 2021 (mandatory) — Every registry MUST publish a signed W3C Status List 2021 credential, served at a stable endpoint advertised in .well-known/trail-registry.json.
• Verifier polling model — ≤1h cache consistent with §8.6. HTTP conditional requests (ETag/Last-Modified). Fail-closed on fetch failure for high-stakes contexts.
• Cross-registry score verification — When Registry B presents a trust score for a DID authoritative to Registry A, the score is NOT canonical. Verifiers MUST fetch raw inputs from Registry A's §7.3.4 endpoint and recompute locally. This eliminates the score-laundering vector where a federated peer could fabricate scores.
• Revocation latency budget — T+0 bit flip → T+≤60s served → T+≤1h all verifiers refreshed.

Section renumbering

Existing §8.7–§8.11 (Key Recovery, Key Rotation, Spec Versioning, Revocation Roadmap, Protocol Roadmap) shifted down to §8.8–§8.12 to make room for the new §8.7. All cross-references, ToC, and historical v1.1.0 changelog entries updated. §8.11 Revocation Roadmap now marked as partially superseded by §8.7.

Why

Closes Challenge Register E-013 — Federation Trust Anchor Model (KRITISCH)

"§3.3 lässt Federation-Modell offen ('MAY operate as standalone'). Amey: 'CA, federated, oder web-of-trust?' Diese Frage determiniert die TSAI-Root-CA-These und die Bootstrap-Strategie. Sie kann NICHT offen bleiben."

Fix: Hybrid model now normative. Tier-1/2/3 defined. Verifier picks via Trust List. No single anchor.

Closes Challenge Register E-014 — Cross-Registry Verification + Revocation Propagation (HOCH)

"§3.3.2 nur HTTP 301. Keine Antwort: Wie wird Score aus Registry A in B verifiziert? Wie propagiert Revocation?"

Fix: Score-inputs from §7.3.4 are canonical, verifier recomputes. Status List 2021 is the normative revocation mechanism with authoritative-registry-per-DID uniqueness.

Out of scope (deliberate)

• Genesis Issuer Set (separate task, target 2026-04-30)
• §7.2.5 Probationary Tier (Issue RFC: Trust Score Algorithm - Seeking Expert Critique #2 follow-up PR)
• §7.3.9 Signal Decay (Issue RFC: Trust Score Algorithm - Seeking Expert Critique #2 follow-up PR)

Spec version

v1.2.0-draft → becomes v1.2.0-rc1 once this PR + PR #12 (evidence-weighted Trust Score) are merged.

Co-architected with

Amey Parle — originator of the federation/trust-anchor analysis that drove this PR.

cc @AmeyParle

[chrishooooo-netizen]

@AmeyParle - this PR-Bundle implements Issue #1 (Federation Trust Anchor Model + Revocation Propagation) following your 13.04.2026 technical memo. §3.4 codifies the Federated Hybrid (Tier-1 Roots / Tier-2 Sub / Tier-3 web-of-trust with D5 Risk Penalty), §8.7 makes Status List 2021 normative with cross-registry score recomputation per §7.3.4. You are credited as Co-Architect in the changelog and commit trailer. Review welcome whenever it suits you.