Leaf lifetime is not determination age — two clocks a delegation chain must not merge
Sources cited in this piece · the thread this piece reads, on the record: WIMSE archive, AIMS placement thread, 6 November · the body of work the distinction comes from: standing of delegated authority at point of use (DOI 10.5281/zenodo.23105657) · the text the wire answers anchor to: draft-li-rttp-iqa-addressing-02 (full text) · series page: datatracker · the family that tests the boundary: iqa.org/conformance/aicent-lease-boundary/ (four files, per-file SHA-256) · the family that tests the vocabulary: iqa.org/conformance/aicent-grant-ref/ · conformance hub: iqa.org/conformance/ · the sibling piece on the other half: the time belongs to the determination · earlier piece on the race: what happens mid-task · Sister pillars: RTTP (rttp://, CRI 27) · IQA (iqa://, CRI 28)
Two clocks run inside every delegation chain, and this week one participant of the WIMSE placement thread — Cliff Singletary — drew the line between them more cleanly than any specification text this series has quoted. He was endorsing the thread's settlement on where the bounding sentences belong, and adding his own requirement on top, in two sentences worth quoting whole: "On ShaoBao's time half: yes, it earns its own sentence, because it is a separate requirement from leaf lifetime. Leaf lifetime bounds how long a withdrawn credential keeps being accepted. It says nothing about how old a determination of the authority behind that credential may be when it is relied on." Twenty-nine words, and a distinction that entire architectures get wrong: the lifetime of a leaf in a chain is not the age of the verifier's belief about the chain — and the two numbers answer different questions at different moments.
Why the two clocks resist being one
The temptation to merge them is structural: both are measured in seconds, both sound like "freshness," and both expire — so an implementer short on registers keeps one. But the merge fails in both directions at once. Give the leaf a short lifetime and hope the determination inherits its freshness, and you have bought nothing: a credential reissued every hour says nothing about when the authority behind it was last actually observed, and an attacker who controls the interval between observations controls the true freshness of every decision regardless of what the leaf says. Give the determination a stated age and expect it to substitute for revocation, and you have the mirror failure: a determination from three seconds ago is still a belief about the past, and no amount of youth in the belief accelerates the network's learning that a leaf was withdrawn at the edge. The two clocks must be carried separately because they bound different guarantees — propagation and honesty — and a guarantee that silently stands proxy for another is the oldest shape of over-read this series documents.
Four quadrants, four verdicts
The distinction becomes operational when you cross the axes, and the crossing is where implementations separate. Leaf valid and determination fresh: the ordinary case — proceed, with the age on the record so the decision is auditable later. Leaf withdrawn and determination fresh: revocation arrived in time — the wire answers authority_revoked, and leaf lifetime is exactly the bound on how long this quadrant can be missed. Leaf valid and determination stale: the quiet quadrant — nothing is visibly wrong, the credential checks out, and the belief behind the check predates the request; the merged-clock implementation sails through here on the leaf's freshness, while the honest one answers on the age of what it actually relied on. Leaf withdrawn and determination stale: the double-stale quadrant — the worst reading of "we established this once," where the system is confident twice over in credentials the world has already moved past. Four quadrants, and the merged clock gets two of them wrong while feeling more current, not less.
The wire answer, value by value
The addressing draft draft-li-rttp-iqa-addressing-02 already carries the distinction as its vocabulary, and the mapping is one-to-one with the quadrants. The withdrawn leaf is authority_revoked — "The authority for the subject has been revoked" — with leaf lifetime as the propagation bound the relying party is owed visibility into. The undeterminable case is authority_not_determined, whose definition ends with the discipline this whole thread has been circling: "An unreachable source is refused under this value, never read as assent." And the age of the determination is not a convention but a member: observation_as_of_ms is null whenever the observation the answer relied on is absent or not fresh — "The member states the age of what the answer actually relied on, not the freshness of the freshest thing the implementation happened to see." Three values and one member, and the two clocks never share a register.
The lineage, credited
One more thing belongs on the record, because this series holds that distinctions with names survive and distinctions without names get re-litigated every six months. Singletary signed his contribution with its lineage: "I set this out as standing of delegated authority at point of use in doi:10.5281/zenodo.23105657." The distinction between how fast revocation reaches the edge and how old the reliance-time belief was is not a fresh coinage of this thread — it is a position someone has been building in the open, under their own name, long enough to have a DOI, and the thread is better for the citation. This series exists on the same wager: that the grammar of delegated authority gets built faster when every load-bearing sentence carries a name and a date. The quadrant table above is our rendering of the distinction; the executable rendering runs in aicent-lease-boundary and aicent-grant-ref on our conformance hub — checker 15/15 and 25/25 respectively, every expectation anchored to a quoted sentence of the published draft — merged in the Agent-Authority-Conformance lab mainline and ready for any implementation that wants its clocks checked.
One line: leaf lifetime bounds how fast the edge learns that a credential died; determination age bounds how honest the decision was when it was made — two clocks, two guarantees, four quadrants, and a chain that merges them will fail in the two quadrants where every visible dial reads fine.