# Revocation trace — testnet — 2026-10-19T01:40:33.773Z

Chain `mintid-testnet-2`, issuer `3d2a9df3cc5cb853…`, verifier `6f4c5d1becd3c47e…`. Raw events: `revocation-trace-testnet-20261019T014033Z.jsonl`. Decision log: not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD).

## Authority evidence

| Field | Value |
|---|---|
| Source | the issuer's status root on chain `mintid-testnet-2`, read by the verifier with an ics23 proof against the node's committed app hash at each decision (R15) |
| Revision | verifier `ba16a283589f` (public-v2026-10-17.1), issuer `ba16a283589f` (public-v2026-10-17.1); verifier engine `proof-core 0.5.0`, SDK 0.5.0, SPEC-1 v3.2 |
| Issuer signing key | `9ddd3b08a70e3506…` (a key id, not a revision) |
| Status/root | before: epoch 41320, finalized height 577614; after: epoch 41322, finalized height 577640 |
| Observation time | before 2026-10-19T01:40:37.000Z; after 2026-10-19T01:42:00.000Z (verifier `/v1/status`) |
| Actual age | before 6 s; after 29 s |
| Deployed freshness limit | 180 s maximum root age (heartbeat 30 s; verifier height lag 100 blocks; K = 5 s) |
| Check performed | condition 5: the proof is verified against the issuer definition (BBS key + accumulator) the newest *provable* finalized root anchors; condition 7: the presented root is the current root, or a ring entry inside its validity window, superseded within the height lag and followed by no emergency root; chain unreadable → refuse |

Presentation lifetime: 10 s (R14) — bounds replay, not revocation; a separate field from the revocation latency below.

Claim policy (every challenge; SHA-256 with the issuer policy `3f9287eb129d770202000903dad785496d9a50e1d5f151f33cc4990ce580c6ef`): `human_backed = True`, `pairwise_pseudonym` (this verifier), `assurance_grade >= A2`, `counterparty_includes = eip155:8453:0x833589fcd6edb6e08f4c7c32d4f71b54bda02913`, `delegated_scope_includes = payments.initiate`, `category_in = mcc:5812`, `geo_in = iso3166-1:ES`, `transaction_limit >= 5000000 USDC`, `unexpired = True`, `credential_active = True`; no key-custody floor: the trace measures revocation propagation, not custody, and an agent minted without key-attestation evidence is appraised `software`.

## Temporal revocation

| Path | Trigger time (t0) | Authority evidence consulted at the denial | Last accepted action | Required deny point (bound) | First observed denial | Root carrying the revocation |
|---|---|---|---|---|---|---|
| issuer | 2026-10-19T01:41:29.483Z — the issuer's removal of the agent (revoke response) | current root epoch 41322 (finalized height 577640, generated 2026-10-19T01:41:31.000Z) | none after t0 (—) | t0 + 185 s (t0 + A + K) = 2026-10-19T01:44:34.483Z | 2026-10-19T01:41:40.453Z (+11.0 s), `status_root_stale` | epoch 41322, finalized height 577640 at 2026-10-19T01:41:31.810Z |

## Measured deny point per path

| Path | First observed denial − t0 | Bound | Within the bound |
|---|---|---|---|
| issuer | 11.0 s | 185 s | yes |

Times are wall-clock UTC of this machine; a root's "finalized at" is the CometBFT block time (BFT time), which trails wall-clock by up to about one block, so it can read earlier than the root's own `generated_at`. Each forced attempt takes about a second (proof + verdict), which is the granularity of the measured points.

## Decision-log lines (R18 fixed-slot records)

| Path | Decision | Verifier answer | Decision-log line |
|---|---|---|---|
| issuer first refused | 2026-10-19T01:41:40.453Z | `status_root_stale` | not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD) |

## Control (issuer path): a sibling agent that is not revoked

The sibling forced a proof over the witness it held at the trigger, never refreshing: last accepted 2026-10-19T01:41:35.478Z, first refused 2026-10-19T01:41:50.044Z `status_root_stale`; after refreshing its witness it was `accepted`.

## Attribution

The verifier's record shows the root a decision rested on; revocation is shown by the failed witness refresh.

A first refusal marks when a root newer than the agent's witness became provable to the verifier, which a never-revoked agent forcing an old witness meets too. A revoked agent cannot obtain a newer witness; a live one can, and is accepted again. Times are seconds after the path's t0.

| Path | Revoked agent | First refused | Witness refresh |
|---|---|---|---|
| issuer | `agent_issuer` | +11.0 s `status_root_stale` | refused +6.8 s, `credential_revoked` |

Control on the issuer path (`sibling_control`, never revoked, forcing the witness it held at the trigger): refused +20.6 s `status_root_stale`; its witness refresh: a newer witness obtained +24.4 s; after the refresh accepted +29.4 s `accepted`.

## Rule

- **issuer**: `status_root_stale`; its decision-log line was not read (not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD)), so the rule that decided is not recorded here.
- **issuer control (never revoked)**: `status_root_stale`; its decision-log line was not read (not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD)), so the rule that decided is not recorded here.