587fb05265
All checks were successful
check / gate (push) Successful in 21s
A revoked passport returns HTTP 200, status=revoked, band=unproven, allowed_actions=[] (verified live 2026-08-13). resolve_passport keyed refusal only on HTTP 4xx and band=="untrusted", so it returned band 'unproven' and the agent was seated. Revocation was NOT enforced on the live auth path at all — and now that agent auth actually works, a revoked agent could authenticate and act. Extracts decide_trust(body) -> (band, actions) | raise. Only status=="active" is allowed; revoked/suspended/frozen/unknown all refuse, fail-closed on the field that carries the most consequential fact about an identity. The agent call site turns that into a clean 403 passport_revoked. This is the REAL revocation gate — the token cannot be un-issued, but its standing is re-checked on every request, so revocation takes effect on the next call with no webhook required. The Eternitas webhook remains useful for invalidating locally-issued credentials/grants (G6.3, not built yet), but it was never the primary gate and its being unwired is no longer a live exposure. Behavioral tests: revoked body refused, active accepted, unknown/missing status fails closed. Co-Authored-By: Claude (Fable 5) <noreply@anthropic.com>