{"protocol":"MNR-CRL-1.0","description":"MarketNow Revocation Registry — signed, append-only revocation list for Agent Trust Cards and CA keys.","crl":{"format":"MNR-CRL-1.0","issuer":"MarketNow Revocation Registry","registry_key":{"key_id":"mn-revoc-002","algorithm":"Ed25519 (RFC 8032)","public_key_spki_base64":"MCowBQYDK2VwAyEAFYU1lGkafN7JVn7aYq07yyOF/csLLDiLVjJbalAGix8="},"ca_key_status":[{"key_id":"ca-key-001","status":"retired","active_since":"2026-07-16T00:00:00Z","retired_at":"2026-08-12T00:00:00Z"},{"key_id":"mn-ca-002","status":"retired-compromised","active_since":"2026-08-12T00:00:00Z","retired_at":"2026-09-08T00:00:00Z"},{"key_id":"mn-ca-003","status":"active","active_since":"2026-09-08T00:00:00Z","retired_at":null}],"this_update":"2026-09-16T21:22:08Z","next_update":"2026-09-23T21:22:08Z","entries":[{"entry_type":"atc","subject":"ATC-2026-5837752","agent_id":"agent.alicelabs.marketnow","agent_name":"MarketNow Discovery Agent","status":"REVOKED","substatus":"SUPERSEDED","revoked_at":"2026-07-18T03:38:45.419Z","reason":"Replaced with new ATC linked to Sentinel certificate (score 10)"},{"entry_type":"atc","subject":"ATC-2026-5936297","agent_id":"agent.alicelabs.marketnow","agent_name":"MarketNow Discovery Agent","status":"REVOKED","substatus":"REVOKED","revoked_at":"2026-07-22T03:11:09.094Z","reason":"Signed with buggy canonicalization — re-issuing with fixed recursive sort"},{"entry_type":"atc","subject":"ATC-2026-9880252","agent_id":"agent.alicelabs.marketnow","agent_name":"MarketNow Discovery Agent","status":"REVOKED","substatus":"REVOKED","revoked_at":"2026-07-23T03:36:06.758Z","reason":"Re-signing with RFC 8785 canonical JSON"},{"entry_type":"ca_key","subject":"mn-ca-002","public_key_spki_base64":"MCowBQYDK2VwAyEATlD16v6Fy/+GM4je2SxwCz7yFEeo9d8LwqZf0yN8oFY=","status":"REVOKED","substatus":"KEY_COMPROMISE","revoked_at":"2026-09-08T00:00:00Z","reason":"Private key material was found committed to a public repository. Any signature that only verifies under this key must be treated as untrusted."},{"entry_type":"atc","subject":"ATC-2026-1509360","agent_id":"skill.mn-sub-51326","agent_name":"awesome-mcp-servers","status":"REVOKED","substatus":"REVOKED","revoked_at":"2026-08-09T19:38:14.746Z","reason":"test","propagation_note":"Revocation recorded in the repo ledger (_data) on 2026-08-09 but never propagated to the public CRL; fixed 2026-09-17."}],"stats":{"total_entries":5,"atc_entries":4,"ca_key_entries":1},"signature":{"algorithm":"Ed25519 (RFC 8032)","domain":"MNR-CRL-1.0","canonicalization":"RFC 8785 JCS","signed_payload_hash":"9463adbaf8332a2946713151aab9f56642be536496302b93f533bec5747c54b9","value":"9af75db1be5be9ca06d63c15ab4167f2076454e8bb97cf36f13b4174b0a46470cc35990c6a1b3b1580aebf92d676b0897ea4d1e21039660ce4be01b45d929d02","signed_at":"2026-09-16T21:22:08Z","verify_with":"GET /uta/revocations/registry-key.json — Ed25519 verify over \"MNR-CRL-1.0:\" + JCS(payload-without-signature)"}},"verification":{"registry_key":{"key_id":"mn-revoc-002","algorithm":"Ed25519 (RFC 8032)","public_key_spki_base64":"MCowBQYDK2VwAyEAFYU1lGkafN7JVn7aYq07yyOF/csLLDiLVjJbalAGix8=","rotation_history":[{"key_id":"mn-revoc-001","status":"retired","rotated_at":"2026-09-16T21:22:08Z"},{"key_id":"mn-revoc-002","status":"active","active_since":"2026-09-16T21:22:08Z"}]},"registry_key_url":"/uta/revocations/registry-key.json","steps":["1. Take crl (or /uta/revocations/crl.json) and remove the \"signature\" object → payload.","2. canonical = \"MNR-CRL-1.0:\" + JCS(payload)  (RFC 8785 — recursive key sort, minimal escaping).","3. sha256(utf8(canonical)) must equal crl.signature.signed_payload_hash.","4. Ed25519-verify canonical bytes against registry_key.public_key_spki_base64 with crl.signature.value (64-byte hex)."],"node_snippet":"const { createPublicKey, verify, createHash } = require('node:crypto');\nconst { crl } = await (await fetch('https://www.marketnow.site/api/crl')).json();\nconst { signature, ...payload } = crl;\nconst canonical = 'MNR-CRL-1.0:' + jcs(payload); // RFC 8785\nconst ok = verify(null, Buffer.from(canonical),\n  createPublicKey({ key: Buffer.from(registryKey.public_key_spki_base64, 'base64'), format: 'der', type: 'spki' }),\n  Buffer.from(signature.value, 'hex'));"},"status_resolution":{"ocsp_endpoint":"/api/ocsp?card_id=… or ?kid=…","semantics":["VALID","EXPIRED","REVOKED","SUSPENDED","SUPERSEDED","UNKNOWN"],"fail_closed":"UNKNOWN → recommendation DENY"},"roadmap":"v5.1 item 5 — ATC Revocation + Transparency Log"}