Listing Disputes, Freezes, and Sanctions

An enforced freeze blocks admission; an unsubstantiated one is recorded

A relying party evaluates the signed case against the live listing and reads back one effective state and one flag.

With a valid charter, an enforced case, and a matching activation at the evaluation time, the listing reads frozen and admission is blocked. Without the activation, the same case returns one MissingActivation finding and blocks_admission = false, so a freeze the evaluator cannot substantiate has no effect on admission. Once the case is resolved, the listing reads clear and only its other admission checks apply.

{
  "body": {
    "schema": "chio.registry.governance-case.v1",
    "caseId": "case-6f2a9c...",
    "charterId": "charter-1d4b0e...",
    "governingOperatorId": "origin-a",
    "kind": "freeze",
    "state": "enforced",
    "namespace": "https://registry.chio.example",
    "listingId": "listing-artifact-1",
    "activationId": "activation-8c71...",
    "subjectOperatorId": "origin-a",
    "openedAt": 140,
    "updatedAt": 140,
    "expiresAt": 500,
    "evidenceRefs": [
      { "kind": "trust_activation", "referenceId": "activation-8c71..." }
    ],
    "issuedBy": "governance@chio.example",
    "note": "freeze"
  },
  "signerKey": "9f2c1a...",
  "signature": "b0e4d7..."
}

A charter bounds which cases its operator may open

A charter names the governing operator, the namespace it covers, its allowed_case_kinds, and optional escalation operators. The builder returns an unsigned body, which the operator signs with a governance-authority keypair issued through chio-federation-authority.

let charter = build_generic_governance_charter_artifact(
    "origin-a",
    Some("Origin A".to_string()),
    &request,
    130,
)?;
let signed = SignedGenericGovernanceCharter::sign(charter, &authority_keypair)?;

authority_scope can pin a charter to specific listing publishers and actor kinds. An empty list leaves that axis unrestricted, because evaluation tests only a list it finds nonempty. The charter id is a content hash over the issuing operator, the normalized namespace, the allowed kinds, and the issue time, so the same inputs always yield the same id.

Registry charters govern listing status. Credit tiers, discount curves, premium schedules, fees, and bonds belong to a separate charter family whose amendments move through propose, m-of-n approval, timelock, and activate before they take effect.

Read more in Fiscal charters.

Case state and kind together decide the effective state

Evaluation maps the case's lifecycle state and kind to a GenericGovernanceEffectiveState (clear, disputed, frozen, sanctioned, or appealed) and the boolean blocks_admission.

The relying party gates on blocks_admission; the effective state is the readable status. A freeze or sanction needs a trust activation from the governing operator whose activation_id matches the case, and an appeal needs appeal_of_case_id plus a matching non-appeal prior_case.

Read every kind's requirement in Case kinds.

Evaluation stops at the first failed check and names it

evaluate_generic_governance_case takes the current listing, the current publisher, the charter, the case, and optionally a trust activation and a prior case. It checks, in order:

1. Shape. The listing body and the current_publisher shape are valid.
2. Signatures. The listing, charter, and case verify, and so do the activation and prior case when present.
3. Issuer. A present activation's local_operator_id equals the charter's governing_operator_id.
4. Identity. Charter, case, and listing agree on governing operator, charter id, namespace, and listing id.
5. Expiry. Neither charter nor case has expired at evaluated_at; expires_at <= evaluated_at is expired.
6. Charter scope. The charter allows the case's kind and, where its scope is set, admits the current publisher operator id and the listing subject actor kind.
7. Supporting records. A freeze or sanction has an activation whose activation_id matches; a superseding case has a matching prior_case; an appeal has a matching non-appeal prior_case.

Success maps the state and kind to an effective state and blocks_admission, with an empty findings list. A failed check returns an Ok evaluation carrying one finding, effective_state = clear, and blocks_admission = false; only a malformed listing or publisher shape, or an internal crypto or canonicalization error, returns Err(String). A clear result with a finding means the case could not be enforced, so read findings beside the other two fields.

let evaluation = evaluate_generic_governance_case(
    &GenericGovernanceCaseEvaluationRequest {
        listing,
        current_publisher,
        activation: Some(activation),
        charter,
        case,
        prior_case: None,
        evaluated_at: Some(150),
    },
    150,
)?;

assert!(evaluation.findings.is_empty());
assert_eq!(evaluation.effective_state, GenericGovernanceEffectiveState::Frozen);
assert!(evaluation.blocks_admission);

The same crate signs capability leases and destructive-step receipts

chio-governance also defines two record groups that govern action authority, with the same signature and schema checks as charters and cases.

• Capability leases (chio.capability-lease.v1) carry a scope digest and an action class of ScopedObservation, DelegatedAction, or NarrowDestructive. verify_capability_lease checks the schema, the signature, the validity window, and an exact scope_digest match.
• Destructive-action governance receipts (chio.governance-receipt.v1) authorize one destructive workflow step. verify_destructive_authorization binds a receipt to an expected lease id, workflow id, and step hash, and verify_step_governance_boundary requires a valid, unexpired receipt for every step marked destructive and none for any other step.

Their issuance path and the checks a caller runs are in Capability leases. Capabilities covers the scoped, time-bounded authority a lease attenuates, and Mandates and capabilities covers how the kernel enforces a destructive-step boundary at runtime.

Next: follow an enforced sanction to a bond