# Revocation trace — testnet — 2026-10-18T13:17:17.158Z

Chain `mintid-testnet-2`, issuer `3d2a9df3cc5cb853…`, verifier `6f4c5d1becd3c47e…`. Raw events: `revocation-trace-testnet-20261018T131717Z.jsonl`. Decision log: not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD).

## Authority evidence

| Field | Value |
|---|---|
| Source | the issuer's status root on chain `mintid-testnet-2`, read by the verifier with an ics23 proof against the node's committed app hash at each decision (R15) |
| Revision | verifier `ba16a283589f` (public-v2026-10-17.1), issuer `ba16a283589f` (public-v2026-10-17.1); verifier engine `proof-core 0.5.0`, SDK 0.5.0, SPEC-1 v3.2 |
| Issuer signing key | `9ddd3b08a70e3506…` (a key id, not a revision) |
| Status/root | before: epoch 39835, finalized height 557022; after: epoch 39837, finalized height 557050 |
| Observation time | before 2026-10-18T13:17:20.000Z; after 2026-10-18T13:18:21.000Z (verifier `/v1/status`) |
| Actual age | before 26 s; after 27 s |
| Deployed freshness limit | 180 s maximum root age (heartbeat 30 s; verifier height lag 100 blocks; K = 5 s) |
| Check performed | condition 5: the proof is verified against the issuer definition (BBS key + accumulator) the newest *provable* finalized root anchors; condition 7: the presented root is the current root, or a ring entry inside its validity window, superseded within the height lag and followed by no emergency root; chain unreadable → refuse |

Presentation lifetime: 10 s (R14) — bounds replay, not revocation; a separate field from the revocation latency below.

Claim policy (every challenge; SHA-256 with the issuer policy `3f9287eb129d770202000903dad785496d9a50e1d5f151f33cc4990ce580c6ef`): `human_backed = True`, `pairwise_pseudonym` (this verifier), `assurance_grade >= A2`, `counterparty_includes = eip155:8453:0x833589fcd6edb6e08f4c7c32d4f71b54bda02913`, `delegated_scope_includes = payments.initiate`, `category_in = mcc:5812`, `geo_in = iso3166-1:ES`, `transaction_limit >= 5000000 USDC`, `unexpired = True`, `credential_active = True`; no key-custody floor: the trace measures revocation propagation, not custody, and an agent minted without key-attestation evidence is appraised `software`.

## Temporal revocation

| Path | Trigger time (t0) | Authority evidence consulted at the denial | Last accepted action | Required deny point (bound) | First observed denial | Root carrying the revocation |
|---|---|---|---|---|---|---|

## Measured deny point per path

| Path | First observed denial − t0 | Bound | Within the bound |
|---|---|---|---|

Times are wall-clock UTC of this machine; a root's "finalized at" is the CometBFT block time (BFT time), which trails wall-clock by up to about one block, so it can read earlier than the root's own `generated_at`. Each forced attempt takes about a second (proof + verdict), which is the granularity of the measured points.

## Decision-log lines (R18 fixed-slot records)

| Path | Decision | Verifier answer | Decision-log line |
|---|---|---|---|

## Out of scope (a binding refusal at the decision)

The agent is delegated `payments.initiate`; the policy asks `delegated_scope_includes` `data.read`, an action of the vocabulary never delegated to it.

| When | What | Answer | Decision-log line |
|---|---|---|---|
| 2026-10-18T13:18:12.976Z | control: the in-scope policy | `accepted` | not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD) |
| 2026-10-18T13:18:15.862Z | the holder asked for the out-of-scope policy | refused (`PolicyUnsatisfiable`, output `delegated_scope_includes_2ceaf66ef7ca34b44b303f33e895baa1ef37f5e49c82e85e223430acdc1e449c`): nothing left the client | — |
| 2026-10-18T13:18:20.046Z | a proof made for an in-scope challenge, submitted under the out-of-scope request | `proof_invalid` (accepted=False) | not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD) |

A verifier's refusal is a decision, not an executor veto: MintID has no executor, so dispatch and committed effect are the relying party's.

## Rule

- **out_of_scope (proof for an in-scope challenge)**: `proof_invalid`; its decision-log line was not read (not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD)), so the rule that decided is not recorded here.