{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://travel.agenthaven.dev/contracts/schemas/key-revocation.schema.json",
  "title": "Key revocation (payload of a key-revocation+jwt)",
  "description": "How a buyer's domain withdraws its word for a stable key: a signed list of the thumbprints it no longer vouches for, published as the `revocations` member of /.well-known/agent-keys.json (schemas/agent-keys.schema.json), beside the attestations. Signed exactly as a key attestation is: by the domain's X509-SVID (x5c chain in the JWS header to a use: x509-svid CA in the bundle) or, in the fallback form, by a use: jwt-svid key from the same bundle named in kid by its thumbprint. The seller reads it whenever it reads the attestations (check 3): an envelope whose kid is listed is refused with identity_revoked at step 3, AFTER the envelope signature verified under the attested key, so the refusal entry names the revoked instance and nobody can produce one for it without its key. The attestation of a revoked key may stay listed: a verifier still needs the key to read the ledger entries that key signed. A revocation the bundle did not sign is ignored, as a bad attestation is. The seller caches a domain's documents for a minute, so the time from publication to the first refusal is the cache plus the next call (F-07b, the identity half of revocation). Status: consumed by the seller since 2026-09-13 (evening); published by agent-buyer (`agent-buyer identity revoke <kid>`, then publish) since the same evening.",
  "type": "object",
  "required": ["iss", "iat", "revoked"],
  "properties": {
    "iss": { "type": "string", "pattern": "^spiffe://", "description": "The SPIFFE ID of the signer: the instance whose SVID signs (x5c), or the trust domain's publishing instance in the fallback form." },
    "iat": { "type": "integer" },
    "revoked": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["kid", "at"],
        "properties": {
          "kid": { "type": "string", "description": "The thumbprint (RFC 7638) of the stable key withdrawn: the kid every envelope it signed carries." },
          "at": { "type": "integer", "description": "When the domain withdrew it, as the domain's clock says; the seller refuses from the moment it reads the document, not from this instant." },
          "reason": { "type": "string" }
        }
      }
    }
  }
}