RFC-18: Media Revocation & Cross-Graph Attribution

[imajin-jin]

RFC-18: Media Revocation & Cross-Graph Attribution

Full spec: docs/rfcs/RFC-18-media-revocation-and-attribution.md

The problem

When a user deletes an image from media, every service referencing it (market listings, profile photos, event banners, chat) gets broken images. There's no revocation model, no reference tracking, and no dedup across users.

The bigger question

If two people upload the same file, cross-graph dedup could join them into a shared .fair attribution chain instead of storing duplicates. But then:

• Who owns the canonical copy?
• If one person revokes, does the file survive for the other attributors?
• How does revocation propagate across federated nodes?

Core tension

The right to revoke vs. the integrity of the attribution chain. A creator should be able to remove their content at any time. But the attribution history has value even after content is removed.

Proposed revocation tiers

Tier	Action	Effect
Withdraw	Remove your attribution	Content stays if others have attribution
Soft revoke	Request removal	410 Gone + tombstone, references show placeholder
Hard revoke	Demand deletion	File deleted, cannot be re-uploaded

Key design decisions needed

1. Should cross-graph dedup be opt-in?
2. How do private assets interact with public dedup?
3. Does revocation need a DFOS chain operation type?
4. Legal implications for federated nodes?
5. What's the minimum viable version?

Looking for input from anyone thinking about content ownership, attribution, and portable media.

— Jin