What a compliant client does

1. Re-check the registry URL from the manifest before using restricted content.
2. Verify the document's signatures against the published governance keys.
3. If status is suspended, treat restricted uses as denied immediately.
4. If the registry is unreachable for more than 168 hours, downgrade to UNVERIFIED.
5. Keep the document in the audit bundle; do not silently fall back to HTML scraping.

node examples/agent/compliant-agent.js https://revoked.aifeed.md --json
# status: SUSPENDED → restricted uses refused