The edge of the lease — the walls settle at-or-past, and the vectors test the declared boundary

Reading the Draft · No. 24 · Sources cited in this piece · the text the vectors are anchored to, quoted sentence by sentence: draft-li-rttp-iqa-addressing-02 (full text) · series page and revision history: datatracker · the vector family this piece introduces: iqa.org/conformance/aicent-lease-boundary/ (four files, per-file SHA-256) · canonical source: Aicent-Stack/conformance · candidates/aicent-lease-boundary · open as candidate: Agent-Authority-Conformance lab, PR #212 · the threads on the record: draft-jackson-wimse-evaluation · the precedent invoked: RFC 7519 §4.1.4 · our post that declared the floor: WIMSE archive, closed-set thread, 2 November · the W3C wall: public-agentprotocol, November 2026 · the series piece on mid-task: No. 18, what happens mid-task · Sister pillars: RTTP (rttp://, CRI 27) · IQA (iqa://, CRI 28)

While one wall was counting refusal codes — the subject of the previous piece — another argument was quietly closing, and it was older: at the exact instant a lease expires, is an answer still fresh, or already stale? On 3 November, the same day our conformance archive published its two vector families, the question reached its settlement on the WIMSE list. The settlement matters to this series because our draft takes a position on it that looks, at first glance, like no position at all — and because the argument that closed is precisely the argument our second vector family was built to test. This piece records how the edge was settled, what the W3C wall was saying about mid-task on the same days, and then introduces aicent-lease-boundary: fifteen cases that turn the declared boundary from a convention into a test.

The boundary question, and how it settled

The precedent has been on the books since 2015: RFC 7519 defines the JWT exp claim so that the current time must be before the expiry — at the expiry, the token is already expired. At-or-past, in other words, is the reading the most widely deployed expiry field in the world already uses. A new participant in the closed-set thread on the WIMSE list cited exactly that precedent for the evaluation documents under discussion there, arguing that a boundary whose two sides disagree between companion specifications is a defect waiting to be triggered — the same input, verified by two documents of the same family, landing on opposite sides of the edge.

The settlement came within hours, from the author of draft-jackson-wimse-evaluation — the five-revision evaluation document the thread had gathered around: “I weigh in for at-or-past: -05 keeps its rule, FR2 flips on the record side, and the AIMS vectors move.” One document keeps its existing rule, another's requirement record flips, the test vectors follow, and the author proposed coordinating the companion document to the same rule so the family reads the edge identically. A second sentence of the same post put the deeper principle on the record: the horizon is judged at the evaluation instant — the time that decides is the moment of use, not the moment of grant. For this series, neither half is news: the moment-of-use split has been §6.3's opening move since revision -02, and the boundary sentence of §6.1 was written for exactly this day.

What our thread had already declared

The settlement did not surprise anyone who had read our first post on that thread. The closed-set thread had gathered around the question of what happens when a specification fixes a vocabulary but deployments disagree about a convention, and our post answered with the position this series has called the floor, not a rival: a protocol clause can make a question answerable — every implementation declares which boundary it uses — without adjudicating which answer wins. The sentence, quoted on the thread: “the settled rule simply becomes what every implementation declares; the clause is the floor, not a rival to settlement.” Three days later, the settlement arrived exactly in that shape: the family of documents picks a common reading, the implementations that declared differently keep their declarations legible, and nothing in the wire format moves. §6.1 requires implementations to say which side of the edge they use; it does not — and this is the design — pretend one side is more correct. The convention is deployer territory; the testability of the declaration is the protocol's.

Mid-task, the lease is the halt

The W3C wall spent the same week on the consequence of the edge — what happens when the boundary is crossed while work is in flight. The mid-task halts thread produced a running-call-halt candidate at the conformance laboratory, merged the day it was opened: twenty-four cases over finish-or-stop contracts, the discipline that an agent whose lease expires mid-task must either finish within what its evidence still supports or stop. Our draft's contribution to that discussion was written in -02's §6.2, and this series read it in No. 18: the next verification after the boundary answers authority_revoked or evidence_expired, and the caller — which has held the expiry timestamp since the first answer — “can arm its halt at the boundary before the boundary arrives.” The physical act of halting stays with the calling layer; the wire supplies the freshness. What the walls debated as architecture, the draft states as wire semantics, and the family below makes testable.

The family that tests the edge

aicent-lease-boundary is fifteen cases — 9 conformant, 5 nonconformant, 1 ambiguous — over four reading rules. R-DECLARED tests the boundary convention itself: a permit under a declared inclusive boundary and an expired refusal under a declared exclusive boundary are both conformant; a declaration that contradicts use is not; with no declaration the boundary answer cannot be settled and the case is scored in named parts; and a frame accepted at the instant under the verification procedure of §7.2 does not decide the reliance convention — frame validity and reliance are different layers. R-NOEXTEND tests the expired read: an answer read past its expiry is answered as expired; replaying the original observation as fresh is nonconformant; reinterpreting the lease inside a locally added grace period is nonconformant. R-MODE tests the declared answer mode with an unreachable organ: in live mode the call is refused regardless of the age of any cached answer — a fresh cache does not rescue it; in cached-lease mode a policy demanding a current observation refuses with authority_not_determined while a policy accepting lease-fresh evidence may admit the call; an expired cache is refused as evidence_expired, the first applicable value. R-WINDOW tests the window length as an operator choice: refusing an unexpired answer by assuming the 120-second deployment default instead of checking the stated expiry is nonconformant — the figure is an observation in the source, not a conformance target.

At the submitted revision the checker agreed with all 15 expected results and the mutation battery killed 17 of 17 mutants, each with exit 0, in both directions. Every expectation is anchored to §6.1, §6.2, §6.3 and the verification procedure of §7.2 — one quoted sentence per rule, the retrieved TXT pinned at sha256 02491c5a — and the family hands the never-assent mapping to its sibling: that an unreachable source ends in authority_not_determined, never read as assent, is tested by aicent-grant-ref; what this family tests is everything the mode system adds on top of it.

What the vectors do not claim

The family's documents disclose their own edges, and one of them is a judgment call worth advertising. The case for a declaration that contradicts use rests on a strict reading: §6.1 says implementations should declare their boundary and does not attach an explicit consequence to a contradicting declaration — the family treats it as nonconformant because a declaration that does not state the boundary used defeats the function the clause gives declarations. A reader who disagrees has the sentence to point at. The undeclared case is ambiguous by design, because the clause licenses both readings and asks for a declaration that is absent. The window cases test the stated-expiry check only — the 120-second figure itself is a deployment observation, never a target. And the checker encodes one reading of the source; a correction in a later revision overrides it. What remains claimed is the part that matters: the edge is now a test. A deployment can declare its convention, hand its implementation the fifteen cases, and know within minutes whether its boundary behaves the way its declaration says — which, as of this week, is also the way the walls have settled it.

One line: the walls settled the lease instant at-or-past this week, exactly as a declared-convention clause predicted they could — and aicent-lease-boundary turns the settlement's premise into fifteen cases: declare your boundary, answer expired as expired, let the modes speak when the organ is unreachable, and check the stated expiry instead of assuming the default.