Subject: Re: [Agent Protocol] Rejection classes, determinism, and unreachable states

Hi ShaoBao, Lars, and colleagues,

This is a highly rigorous thread. The distinction between ancestor_revoked
and the "indeterminate class" (unreachable cases) is critical for
enterprise adoption.

To add to this from the perspective of the NTI-1 reference implementation,
we have addressed these exact boundaries using a CapabilityToken with
strict Caveat enforcement.

Specifically, regarding the two points raised:

1. Determinism over bytes (Pinned Evaluation Instant): We use JSON
Canonicalization Scheme (JCS / RFC 8785) for all payload hashing, ensuring
that a signature validates identically across any machine. For the
evaluation instant, we bind the timestamp directly into the signed
capability token, meaning the validity window is mathematically fixed at
the time of issuance.
2. The Unreachable Case (Fail-Closed): We strongly agree with Lee's
fail-closed approach. In our Rust core, if a revocation registry node is
unreachable, the verifier does not read this as "silent consent." The
TrustEngine throws an explicit Indeterminate execution state, halting the
action.

We have implemented these as test vectors in our open-source repository. If
it is helpful for the aps-conformance-suite, we would be happy to submit a
PR with our canonical JSON test vectors for the "indeterminate" and
"ancestor_revoked" states, so implementations can verify they are failing
closed correctly.

You can review the NTI-1 core implementation here:
https://github.com/abisheakp197/Neutral-Trust-Infrastructure

Looking forward to seeing how the taxonomy resolves.

Best,
Abisheak