# Revocation trace — testnet — 2026-10-19T01:58:19.168Z

Chain `mintid-testnet-2`, issuer `3d2a9df3cc5cb853…`, verifier `6f4c5d1becd3c47e…`. Raw events: `revocation-trace-testnet-20261019T015819Z.jsonl`. Decision log: not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD).

## Authority evidence

| Field | Value |
|---|---|
| Source | the issuer's status root on chain `mintid-testnet-2`, read by the verifier with an ics23 proof against the node's committed app hash at each decision (R15) |
| Revision | verifier `ba16a283589f` (public-v2026-10-17.1), issuer `ba16a283589f` (public-v2026-10-17.1); verifier engine `proof-core 0.5.0`, SDK 0.5.0, SPEC-1 v3.2 |
| Issuer signing key | `9ddd3b08a70e3506…` (a key id, not a revision) |
| Status/root | before: epoch 41355, finalized height 578101; after: epoch 41359, finalized height 578152 |
| Observation time | before 2026-10-19T01:58:22.000Z; after 2026-10-19T02:00:14.000Z (verifier `/v1/status`) |
| Actual age | before 21 s; after 12 s |
| Deployed freshness limit | 180 s maximum root age (heartbeat 30 s; verifier height lag 100 blocks; K = 5 s) |
| Check performed | condition 5: the proof is verified against the issuer definition (BBS key + accumulator) the newest *provable* finalized root anchors; condition 7: the presented root is the current root, or a ring entry inside its validity window, superseded within the height lag and followed by no emergency root; chain unreadable → refuse |

Presentation lifetime: 10 s (R14) — bounds replay, not revocation; a separate field from the revocation latency below.

Claim policy (every challenge; SHA-256 with the issuer policy `3f9287eb129d770202000903dad785496d9a50e1d5f151f33cc4990ce580c6ef`): `human_backed = True`, `pairwise_pseudonym` (this verifier), `assurance_grade >= A2`, `counterparty_includes = eip155:8453:0x833589fcd6edb6e08f4c7c32d4f71b54bda02913`, `delegated_scope_includes = payments.initiate`, `category_in = mcc:5812`, `geo_in = iso3166-1:ES`, `transaction_limit >= 5000000 USDC`, `unexpired = True`, `credential_active = True`; no key-custody floor: the trace measures revocation propagation, not custody, and an agent minted without key-attestation evidence is appraised `software`.

## Temporal revocation

| Path | Trigger time (t0) | Authority evidence consulted at the denial | Last accepted action | Required deny point (bound) | First observed denial | Root carrying the revocation |
|---|---|---|---|---|---|---|
| kill_switch | 2026-10-19T01:59:33.666Z — the recording of the nullifier on chain (block time of the relay's tx) | current root epoch 41359 (finalized height 578152, generated 2026-10-19T02:00:02.000Z) | 2026-10-19T02:00:01.173Z (+27.5 s) | t0 + 245 s (t0 + G + A + K) = 2026-10-19T02:03:38.666Z | 2026-10-19T02:00:07.467Z (+33.8 s), `status_root_stale` | epoch 41359, finalized height 578152 at 2026-10-19T02:00:01.377Z |

## Measured deny point per path

| Path | First observed denial − t0 | Bound | Within the bound |
|---|---|---|---|
| kill_switch | 33.8 s | 245 s | yes |

Times are wall-clock UTC of this machine; a root's "finalized at" is the CometBFT block time (BFT time), which trails wall-clock by up to about one block, so it can read earlier than the root's own `generated_at`. Each forced attempt takes about a second (proof + verdict), which is the granularity of the measured points.

## Decision-log lines (R18 fixed-slot records)

| Path | Decision | Verifier answer | Decision-log line |
|---|---|---|---|
| kill_switch last accepted | 2026-10-19T02:00:01.173Z | `accepted` | not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD) |
| kill_switch first refused | 2026-10-19T02:00:07.467Z | `status_root_stale` | not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD) |

## Attribution

The verifier's record shows the root a decision rested on; revocation is shown by the failed witness refresh.

A first refusal marks when a root newer than the agent's witness became provable to the verifier, which a never-revoked agent forcing an old witness meets too. A revoked agent cannot obtain a newer witness; a live one can, and is accepted again. Times are seconds after the path's t0.

| Path | Revoked agent | First refused | Witness refresh |
|---|---|---|---|
| kill_switch | `agent_kill_switch` | +33.8 s `status_root_stale` | refused +29.8 s, `credential_revoked` |

## Rule

- **kill_switch**: `status_root_stale`; its decision-log line was not read (not read (operator only: MINTID_VERIFIER_CONSOLE_PASSWORD)), so the rule that decided is not recorded here.