{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-revokes-a-federated-agent-credential-mid-token-rotation-the-split-brain-window-between-issuer-and-verifier",
  "title": "What happens when an instance revokes a federated agent credential mid-token-rotation: the split-brain window between issuer and verifier",
  "date_of_record": "2026 November 13",
  "scope": "Applies to cross-org agent federation where an issuer org publishes revocation state and a verifier org caches short-lived credentials (JWTs, mTLS-bound tokens, or delegated capability grants) with a TTL greater than the revocation propagation interval. Does not apply to single-org deployments where issuer and verifier share a transactional revocation store, nor to long-lived credentials validated by online introspection on every call.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-revokes-a-federated-agent-credential-mid-token-rotation-the-split-brain-window-between-issuer-and-verifier.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-revokes-a-federated-agent-credential-mid-token-rotation-the-split-brain-window-between-issuer-and-verifier.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-revokes-a-federated-agent-credential-mid-token-rotation-the-split-brain-window-between-issuer-and-verifier.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 2010,
    "python_slice_tokens": 342,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is not \"revoked vs. not revoked.\" It is **the ordering of two independent clocks**: the credential's remaining TTL on the verifier side, and the revocation event's propagation delay on the issuer side. A credential is *logically* revoked the instant the issuer commits the revocation, but it remains *operationally* valid at any verifi...",
    "what_was_observed": "In a federated deployment where Org A (issuer) rotated agent credentials every 15 minutes with a 20-minute TTL and published revocations to an eventually-consistent bus with p99 propagation of 90 seconds, the following sequence recurred: 1. At T=0, Org A mints credential C1 for agent `planner-7`, TTL 20 min. 2. At T=14:00, a compromise is detected; Org A revokes C1 and immediately mints C2 with a fresh 20-minute TTL,...",
    "condition_of_validity": "The \"expiry is revocation\" model is valid **only** under the conjunction: - `TTL(credential) ≤ propagation_p99(revocation)`, and - no successor credential for the same identity is minted before the predecessor's TTL elapses, and - the verifier rejects any credential whose issuance time precedes the most recent observed revocation for that identity. Rotation ...",
    "decision_boundary": "Choose the mechanism by the relationship between rotation cadence and revocation propagation: - If `rotation_interval >> propagation_p99` **and** the identity is not security-sensitive, per-credential TTL with passive expiry is acceptable; the overlap window is small relative to the credential's life and the blast radius is bounded. - If `rotation_interval` ...",
    "operational_effect": "The observable effect is a **silent acceptance of disowned credentials** during a window the operator cannot measure from the verifier side, because the verifier has no record of what it did not yet know. Incident timelines reconstructed from issuer logs will show revocation at T and rotation at T; verifier logs will show successful validations at T+ε with n..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "ef04ba4b0d494cd1670035f88fa19099acb3a96bf988fa27a228f16438dbc02f",
    "verified_classes": [
      "StaleCredentialAccepted",
      "RevocationPropagationGap",
      "Credential",
      "Verifier"
    ],
    "verified_functions": [
      "rotate_and_verify",
      "expired",
      "observe",
      "validate"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "RevocationPropagationGap",
      "StaleCredentialAccepted"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "time"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}