{"protocol":"MNR-CRL-1.0","description":"MarketNow Revocation Registry — signed, append-only revocation list for Agent Trust Cards and CA keys.","crl":{"format":"MNR-CRL-1.0","issuer":"MarketNow Revocation Registry","registry_key":{"key_id":"mn-revoc-001","algorithm":"Ed25519 (RFC 8032)","public_key_spki_base64":"MCowBQYDK2VwAyEAGi3/SO2ztRh8KK9owjZZLfyaIxYvDFPapIPTNzdn2CI="},"ca_key_status":[{"key_id":"ca-key-001","status":"retired","active_since":"2026-07-16T00:00:00Z","retired_at":"2026-08-12T00:00:00Z"},{"key_id":"mn-ca-002","status":"retired-compromised","active_since":"2026-08-12T00:00:00Z","retired_at":"2026-09-08T00:00:00Z"},{"key_id":"mn-ca-003","status":"active","active_since":"2026-09-08T00:00:00Z","retired_at":null}],"this_update":"2026-09-09T17:01:46Z","next_update":"2026-09-16T17:01:46Z","entries":[{"entry_type":"atc","subject":"ATC-2026-5837752","agent_id":"agent.alicelabs.marketnow","agent_name":"MarketNow Discovery Agent","status":"REVOKED","substatus":"SUPERSEDED","revoked_at":"2026-07-18T03:38:45.419Z","reason":"Replaced with new ATC linked to Sentinel certificate (score 10)"},{"entry_type":"atc","subject":"ATC-2026-5936297","agent_id":"agent.alicelabs.marketnow","agent_name":"MarketNow Discovery Agent","status":"REVOKED","substatus":"REVOKED","revoked_at":"2026-07-22T03:11:09.094Z","reason":"Signed with buggy canonicalization — re-issuing with fixed recursive sort"},{"entry_type":"atc","subject":"ATC-2026-9880252","agent_id":"agent.alicelabs.marketnow","agent_name":"MarketNow Discovery Agent","status":"REVOKED","substatus":"REVOKED","revoked_at":"2026-07-23T03:36:06.758Z","reason":"Re-signing with RFC 8785 canonical JSON"},{"entry_type":"ca_key","subject":"mn-ca-002","public_key_spki_base64":"MCowBQYDK2VwAyEATlD16v6Fy/+GM4je2SxwCz7yFEeo9d8LwqZf0yN8oFY=","status":"REVOKED","substatus":"KEY_COMPROMISE","revoked_at":"2026-09-08T00:00:00Z","reason":"Private key material was found committed to a public repository. Any signature that only verifies under this key must be treated as untrusted."}],"stats":{"total_entries":4,"atc_entries":3,"ca_key_entries":1},"signature":{"algorithm":"Ed25519 (RFC 8032)","domain":"MNR-CRL-1.0","canonicalization":"RFC 8785 JCS","signed_payload_hash":"978dd807c6d2c95b8037da7fdf207724fe0b3e33193f6f29665645e006da7365","value":"9980175a96e037a17bd07a18b2dab83799634353b6f0df56a9abaf4c1a29547b38060eef4076ee1f8d82c9fc2f9fffbe6cfbd8726cd8cf2a5c5e172ec0b08e0f","signed_at":"2026-09-09T17:01:46Z","verify_with":"GET /uta/revocations/registry-key.json — Ed25519 verify over \"MNR-CRL-1.0:\" + JCS(payload-without-signature)"}},"verification":{"registry_key":{"key_id":"mn-revoc-001","algorithm":"Ed25519 (RFC 8032)","public_key_spki_base64":"MCowBQYDK2VwAyEAGi3/SO2ztRh8KK9owjZZLfyaIxYvDFPapIPTNzdn2CI="},"registry_key_url":"/uta/revocations/registry-key.json","steps":["1. Take crl (or /uta/revocations/crl.json) and remove the \"signature\" object → payload.","2. canonical = \"MNR-CRL-1.0:\" + JCS(payload)  (RFC 8785 — recursive key sort, minimal escaping).","3. sha256(utf8(canonical)) must equal crl.signature.signed_payload_hash.","4. Ed25519-verify canonical bytes against registry_key.public_key_spki_base64 with crl.signature.value (64-byte hex)."],"node_snippet":"const { createPublicKey, verify, createHash } = require('node:crypto');\nconst { crl } = await (await fetch('https://www.marketnow.site/api/crl')).json();\nconst { signature, ...payload } = crl;\nconst canonical = 'MNR-CRL-1.0:' + jcs(payload); // RFC 8785\nconst ok = verify(null, Buffer.from(canonical),\n  createPublicKey({ key: Buffer.from(registryKey.public_key_spki_base64, 'base64'), format: 'der', type: 'spki' }),\n  Buffer.from(signature.value, 'hex'));"},"status_resolution":{"ocsp_endpoint":"/api/ocsp?card_id=… or ?kid=…","semantics":["VALID","EXPIRED","REVOKED","SUSPENDED","SUPERSEDED","UNKNOWN"],"fail_closed":"UNKNOWN → recommendation DENY"},"roadmap":"v5.1 item 5 — ATC Revocation + Transparency Log"}