{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-the-revocation-propagation-horizon-in-federated-agent-identity-and-cross-domain-aaif-credential-lifecycle-synchroniza",
  "title": "What structural signals indicate the revocation propagation horizon in federated agent identity and cross-domain AAIF credential lifecycle synchronization",
  "date_of_record": "2026 November 12",
  "scope": "Applies to federated deployments where AI agent identities are issued under AAIF-style credentials across two or more trust domains and revocation events must propagate between domains. Does not apply to single-domain AAIF deployments with a shared revocation authority, nor to stateless bearer tokens without a lifecycle binding.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-the-revocation-propagation-horizon-in-federated-agent-identity-and-cross-domain-aaif-credential-lifecycle-synchroniza.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-the-revocation-propagation-horizon-in-federated-agent-identity-and-cross-domain-aaif-credential-lifecycle-synchroniza.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-the-revocation-propagation-horizon-in-federated-agent-identity-and-cross-domain-aaif-credential-lifecycle-synchroniza.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1656,
    "python_slice_tokens": 193,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure that matters is not \"revocation did not propagate.\" It is the distinction between **revocation propagation** (the event of a domain learning that a credential was revoked) and **revocation enforcement** (the act of refusing operations under that credential). These decouple at a horizon determined by the slower of two clocks: the cross-domain sync...",
    "what_was_observed": "In a three-domain federation (issuer A, relying party B, relying party C) using AAIF credentials with a 90-second cross-domain sync interval and a 300-second local validation cache, the following was measured during a forced revocation of an agent credential at issuer A: - At t+0, A publishes revocation event with sequence `S=4417` and a signed `revoked_at` timestamp. - B receives the event at t+92s (one sync interva...",
    "condition_of_validity": "These signals are valid only when all of the following hold: 1. Revocation and enforcement use separate code paths with separate state (revocation set vs. validation cache). If enforcement reads the revocation set directly on every decision, the horizon collapses to the sync interval and the gap signal is meaningless. 2. The AAIF credential carries a monoton...",
    "decision_boundary": "The operational decision is whether to treat the current horizon as acceptable or to force a reconciliation. The boundary is crossed when **either** condition is met: - The enforcement lag `L = cache_TTL - sync_interval` (measured from revocation receipt, not publication) exceeds the maximum tolerable window of unauthorized operation for the credential's pri...",
    "operational_effect": "Applying the gap and key-shape signals changes three operational behaviors. First, revocation dashboards must report two numbers per domain — highest received sequence and highest enforced sequence — and alert on the gap, not on sync success. Second, AAIF credential issuance must treat `lifecycle_epoch` as part of the revocation key at issue time; retrofitti..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4f375045c6a465544f09b6e28b5f5f445cbf9cba05e94b4d5a2920593ecbe491",
    "verified_classes": [
      "RevocationHorizonError",
      "RevocationState"
    ],
    "verified_functions": [
      "assert_enforcement_current"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "RevocationHorizonError"
    ],
    "sample_fail_closed_invariants": [
      "revocation key omits lifecycle_epoch; re-issued credentials cannot be distinguished from revoked predecessors"
    ],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}