Re:Re:Subject: Re: [public-agentprotocol] Revocation vocabulary and runtime halt

Lee, Xinghua, Larry, all,

On the sixth value, Lee is right and I would not add one. authority_not_determined already carries that case at the boundary, and in the published fixtures it is the most frequent refusal of the five.

The runtime layer has no equivalent, and that is where I would put the remaining work. A sidecar reaches its next boundary check and cannot learn the registry state. No trigger is observed, so there is no ANOMALY, so there is no PAUSE, and the chain stays ACTIVE under an authority nobody could confirm. A Merkle proof against a stale root verifies exactly as one against the current root, and the proof carries no age for the root it was checked against.

Lee, this is the part I would qualify in the latency bound. One window bounds how long activity persists after each verification that returns an answer. A verification that returns nothing starts no new window. The wall-clock bound is therefore one window per successful read.

It fits Larry's test without new apparatus. Beside t_effective, t_observed, t_last_effect and t_receipt, record the registry version the runtime actually read and the instant it read it. A run against an unreachable registry then separates from a run that was told "not revoked". Next to the deliberately defective runtime Larry proposed, a runtime that cannot reach the registry and keeps going is the case I would most want in the family.

Whether the lifecycle grows a state for it, or the receipt simply carries the read, is for the group.

Cheers
Lars


lars@moltrust.ch
https://moltrust.ch