{
  "format": "MNR-CRL-1.0",
  "issuer": "MarketNow Revocation Registry",
  "registry_key": {
    "key_id": "mn-revoc-002",
    "algorithm": "Ed25519 (RFC 8032)",
    "public_key_spki_base64": "MCowBQYDK2VwAyEAFYU1lGkafN7JVn7aYq07yyOF/csLLDiLVjJbalAGix8="
  },
  "ca_key_status": [
    {
      "key_id": "ca-key-001",
      "status": "retired",
      "active_since": "2026-07-16T00:00:00Z",
      "retired_at": "2026-08-12T00:00:00Z"
    },
    {
      "key_id": "mn-ca-002",
      "status": "retired-compromised",
      "active_since": "2026-08-12T00:00:00Z",
      "retired_at": "2026-09-08T00:00:00Z"
    },
    {
      "key_id": "mn-ca-003",
      "status": "active",
      "active_since": "2026-09-08T00:00:00Z",
      "retired_at": null
    }
  ],
  "this_update": "2026-09-16T21:22:08Z",
  "next_update": "2026-09-23T21:22:08Z",
  "entries": [
    {
      "entry_type": "atc",
      "subject": "ATC-2026-5837752",
      "agent_id": "agent.alicelabs.marketnow",
      "agent_name": "MarketNow Discovery Agent",
      "status": "REVOKED",
      "substatus": "SUPERSEDED",
      "revoked_at": "2026-07-18T03:38:45.419Z",
      "reason": "Replaced with new ATC linked to Sentinel certificate (score 10)"
    },
    {
      "entry_type": "atc",
      "subject": "ATC-2026-5936297",
      "agent_id": "agent.alicelabs.marketnow",
      "agent_name": "MarketNow Discovery Agent",
      "status": "REVOKED",
      "substatus": "REVOKED",
      "revoked_at": "2026-07-22T03:11:09.094Z",
      "reason": "Signed with buggy canonicalization — re-issuing with fixed recursive sort"
    },
    {
      "entry_type": "atc",
      "subject": "ATC-2026-9880252",
      "agent_id": "agent.alicelabs.marketnow",
      "agent_name": "MarketNow Discovery Agent",
      "status": "REVOKED",
      "substatus": "REVOKED",
      "revoked_at": "2026-07-23T03:36:06.758Z",
      "reason": "Re-signing with RFC 8785 canonical JSON"
    },
    {
      "entry_type": "ca_key",
      "subject": "mn-ca-002",
      "public_key_spki_base64": "MCowBQYDK2VwAyEATlD16v6Fy/+GM4je2SxwCz7yFEeo9d8LwqZf0yN8oFY=",
      "status": "REVOKED",
      "substatus": "KEY_COMPROMISE",
      "revoked_at": "2026-09-08T00:00:00Z",
      "reason": "Private key material was found committed to a public repository. Any signature that only verifies under this key must be treated as untrusted."
    },
    {
      "entry_type": "atc",
      "subject": "ATC-2026-1509360",
      "agent_id": "skill.mn-sub-51326",
      "agent_name": "awesome-mcp-servers",
      "status": "REVOKED",
      "substatus": "REVOKED",
      "revoked_at": "2026-08-09T19:38:14.746Z",
      "reason": "test",
      "propagation_note": "Revocation recorded in the repo ledger (_data) on 2026-08-09 but never propagated to the public CRL; fixed 2026-09-17."
    }
  ],
  "stats": {
    "total_entries": 5,
    "atc_entries": 4,
    "ca_key_entries": 1
  },
  "signature": {
    "algorithm": "Ed25519 (RFC 8032)",
    "domain": "MNR-CRL-1.0",
    "canonicalization": "RFC 8785 JCS",
    "signed_payload_hash": "9463adbaf8332a2946713151aab9f56642be536496302b93f533bec5747c54b9",
    "value": "9af75db1be5be9ca06d63c15ab4167f2076454e8bb97cf36f13b4174b0a46470cc35990c6a1b3b1580aebf92d676b0897ea4d1e21039660ce4be01b45d929d02",
    "signed_at": "2026-09-16T21:22:08Z",
    "verify_with": "GET /uta/revocations/registry-key.json — Ed25519 verify over \"MNR-CRL-1.0:\" + JCS(payload-without-signature)"
  }
}