AICENT.COM
← Back to Blog

'We established this once' quietly becomes 'this is established' — the time half is a property of the determination

2026-11-07 · RTTP · IQA
Sources cited in this piece · the thread this piece reads, on the record: WIMSE archive, AIMS placement thread, 6 November · the text the discussion anchors to: draft-li-rttp-iqa-addressing-02 (full text) · series page: datatracker · the family that makes the distinction executable: iqa.org/conformance/aicent-lease-boundary/ (four files, per-file SHA-256) · conformance hub: iqa.org/conformance/ · the companion piece on the other clock: leaf lifetime is not determination age · earlier pieces in this line: the interpreter and the clock · the 120-second lease · Sister pillars: RTTP (rttp://, CRI 27) · IQA (iqa://, CRI 28)

Some protocol bugs are code; the expensive ones are grammar. This week, in the WIMSE thread on where AIMS should state its cross-domain boundary, a participant in the placement discussion — Jiahui Miao — put her finger on the most expensive grammar in the delegated-authority stack, and she did it in the form this series values most: not a position, a caution about a sentence. Her subject was the time half of issuer trust, and her caution deserves to be quoted whole, because the wording is already doing the work: "state the time half as a property of the determination, not of the credential. Credentials already carry their own expiry; what implementers over-read is the determination — 'we established this once' quietly becoming 'this is established.'"

two clocks · the credential's & the determination'sthe over-read happens when an implementer reads the wrong dial — the credential's expiry for the determination'sclock 1 · the credentialcarries its own expiry — on its face, in its claim set, auditableclock 2 · the determinationmade from evidence observed at a moment — has NO clock of its own unless the protocol gives it onethe over-read"we established this once" → "this is established" — a sentence with no tense, no clock, no decaycredential valid + determination stale = the dangerous quadrant — every dial the implementer can see says finethe failure is invisible precisely because the visible clock is honest — the honest clock is just not the one that mattersthe fix is a member, not a memoobservation_as_of_ms — the age of what the answer relied on, on every responsetrust is a verb with a tense — the tense lives in the determination, not in the credential that triggered it
Figure 1: the two-clock problem. The credential's expiry is honest and visible; the determination's age is invisible by default — and the over-read replaces one with the other.

Why the over-read is structural, not careless

It would be comforting to call this an implementation bug, but the over-read is built into the object model most delegation work starts from. A credential is a thing you can hold; a determination is an event that happened inside a verifier at a moment. Things persist, events do not — so when a system needs to answer "may this call proceed," it reaches for the thing it has, which is the credential, and lets the credential's clock stand proxy for the determination's. The proxy is never exact: a determination made on Monday from evidence that expired Monday night is not a Monday determination on Tuesday, no matter how valid the credential in hand looks. Nothing in the credential records what the verifier concluded or when — and so the conclusion acquires the credential's lifetime by inheritance, which is to say by accident. Accidental lifetimes on security decisions are how systems fail: quietly, in the quadrant where every visible dial reads fine.

The sentence she proposed, and why we are adopting it with her name on it

The thread's placement question — where the bounding sentences belong, gap text or §10.4 — was settled by two participants independently converging on the same split, which is a good sign for any wording. But the sentence this piece wants to carry forward is Miao's time half, and she offered it in a candidate form marked as hers: "a determination made from observed evidence holds at the time of observation; it does not by itself hold after that evidence expires." We are adopting that sentence into our working notes for the next revision of the addressing draft, with the attribution stated here in plain text rather than buried in an acknowledgements section — because a normative sentence with a name and a date attached is a checkable claim, and an unnamed rule is just folklore with better grammar. Every prior borrowing this series has documented got its power from the same absence: no name, no date, no record of who said the thing when. Attribution is the counter, and it costs one line.

two bounding sentences · two failure modes · one gap statementthe two halves fail differently — which is why they are two sentences and not onesentence 1 · what issuer trust does not decideaccepting another domain's issuer ≠ authorization for this action — fails at first contactsentence 2 · when a determination stops decidingholds at the time of observation — does not by itself hold after the evidence expiresfailure mode 1issuer trust stands in for the domain's own evaluation — the collapsed-vocabulary bugfailure mode 2a stale determination replayed as current — the missing-clock bugwire anchors: authority_not_determined ≠ operation_not_permitted (§8.1) · observation_as_of_ms null-when-stale (§8.2)one sentence each — the gap statement can afford two lines; the failures cost more
Figure 2: the two halves the thread settled on. One bounds what issuer trust decides; the other bounds how long a determination lasts — distinct sentences because their failure modes are distinct.

What the wire already does with the tense

The grammar she is asking for is not hypothetical; the addressing draft already implements it, and the implementation is worth reading as a worked answer to her caution. The grant reference every response carries includes a member named observation_as_of_ms, and the draft gives it a rule with teeth: "observation_as_of_ms is null whenever the observation the answer relied on is absent or not fresh, even if a later, successful observation is available at answer time. A diagnostic or opportunistic read performed after the relied-on evidence expired does not backfill the member: diagnostic reads do not participate in authorisation and do not renew evidence. The member states the age of what the answer actually relied on, not the freshness of the freshest thing the implementation happened to see." Read that against the two-clock problem and the design intent is exact: the credential keeps its clock; the determination gets its own; and the response is forbidden from passing one off as the other. The executable form runs in aicent-lease-boundary — fifteen cases over the lease sections, checker 15/15, mutants 17/17, every expectation anchored to a quoted sentence of the published text — merged in the Agent-Authority-Conformance lab mainline, downloadable from our conformance hub with per-file digests.

The deep point

Strip the protocol vocabulary and what remains is a sentence about the shape of trust itself: trust is a verb with a tense. "We established" is past; "this is established" is a false present; the honest form needs the observation time attached or it silently conjugates itself into the false one. That is why the time half belongs to the determination and not to the credential — the credential is evidence about the world, the determination is the system's belief about the evidence, and beliefs are exactly the things that do not stay true by standing still. A protocol that gives every determination a stated age on every response is not adding bureaucracy; it is refusing to let the past tense borrow the present one's clothes.

One line: the time half is a property of the determination, not of the credential — a determination made from observed evidence holds at the time of observation and does not by itself hold after that evidence expires, so the wire owes every answer a stated age, and the sentence now has a name on it.

SEALED rttp://f183ff0f.blog.aicent · iqa://f183ff0f840b6b40bce566f84785defc.forge.iqa · seal record