Vouch Expiration and Activity Based Auto Renewal

right now once someone is added to the list they stay there indefinitely unless a maintainer manually steps in to remove them. I’m interested in implementing a way to handle "trust decay" so that we don’t end up with a permanent list of people who may no longer be active or whose accounts could eventually be compromised

my idea is to add optional expiration dates to the .td file that get updated automatically whenever a contributor has a PR merged this way active contributors never have to worry about their status expiring but people who stop participating will eventually drop off the list naturally it keeps the security tight without adding any extra manual work for you guys i'd love to know if this sounds like a good direction to take the project

Start by reading the existing .td files and the project’s handling of contributors who are added to the list. Then trace how merged pull requests are recognized, if that entry point exists, and define how optional expiration dates, renewal, and removal should interact. Done means the project has an agreed design and coverage for expiration and activity-based renewal.