feat: add pre-flight CS-010 - Revocation Mechanism

[artur-reaboi-egov]

Summary

This adds CS-010 as a pre-flight CS (per the Pre-flight CS ADR, PR #245) that translates the Attestation Revocation Mechanism ADR (PR #65) — the adoption of the IETF Token Status List — into testable conformance expectations for Issuers, Wallet Units and Relying Parties.

Closes #188.

Contents

• CS-010 document (conformance-specs/cs-10-revocation-mechanism.md)
  • Defines revocation of PID, EBWOID and other attestations valid for more than 24 hours, using the IETF Token Status List (pinned to draft-ietf-oauth-status-list-20, aligned with CS-004)
  • Normative requirements for Issuers (ISS-RV-01–13), Wallet Units (WU-RV-01–04) and Relying Parties (RP-RV-01–06), mapped to ADR ADR for Revocation Mechanism #65, ARF Annex 2 Topic 7 (VCR_xx) and CIR (EU) 2024/2977 Article 5
  • High-level flows: status assignment at issuance (herd-privacy-preserving random list/index allocation), revocation execution (triggers, ≤ 1 h publication, 24 h Holder notification), status verification at presentation (caching, risk analysis fallback), and proactive monitoring (WUA revocation cascade per CS-004)
  • Interface definitions: status claim in the attestation and Status List Token retrieval (application/statuslist+jwt)
  • Simplification: a dedicated Revocation Status Service is explicitly out of scope — the Issuer publishes and serves its Status List Tokens itself
  • Open topics for testing feedback: Authentic Source → Issuer and Wallet Provider → Issuer notification protocols, Holder-initiated revocation requests, Attestation Revocation List fallback, cascade revocation of dependent attestations, publication latency
• README update: CS-010 added to the under-development table

Dependencies

• Based on the merged ADR Attestation Revocation Mechanism #65
• Follows the pre-flight CS process defined in a pre-flight CS #245
• Complements CS-001 (Credential Issuance) and CS-004 (WUA Lifecycle); CS-004 remains authoritative for WUA revocation itself

References

• IETF Token Status List: https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/20/
• CIR (EU) 2024/2977, Article 5: https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj
• EUDI Wallet ARF, Annex 2, Topic 7: https://eu-digital-identity-wallet.github.io/eudi-doc-architecture-and-reference-framework/
• OpenID4VC HAIP 1.0: https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0.html