checkId: doctor.evidence.timestamp.revocation.stapling-present family: doctor-check/v1 service: evidence-web scope: installation severity: warning tags: [timestamping, revocation, stapling, issuance, evidence]

Revocation Material Stapled at Issuance

Stella Ops is self-hosted software. It does not issue electronic time stamps or provide any qualified trust service. This deployment performs local verification using operator-supplied evidence. Unless an approved jurisdiction-, provider-, service-, and deployment-specific claim profile applies, qualified status is not determined.

Compares the timestamps issued in the window with the number that were stored together with their signer’s revocation material, when the issuance policy requires that capture. Long-term validation of a token without its revocation material depends on material that must be fetched later. Default severity when it fails: warning. Installation-scoped: one result per estate, served on the Evidence doctor path and probed on the worker schedule revocation-refresh (hourly).

What it measures

• Passes when the issuance policy does not require capture, or when nothing was issued in the window.
• Fails with the shortfall when policy requires capture and some issued timestamps carry none.

The check never reports a pass for a value it does not have. When its source cannot be read it reports unhealthy with the message Source unavailable (<reason>): <detail>. No verdict can be reported. and the evidence keys source.state=unavailable, source.reason (one of source-not-configured, source-configuration-invalid, unavailable-by-sealed-policy, source-material-invalid, source-read-failed) and source.detail.

Evidence keys

• stapling.issuedInWindow
• stapling.issuedWithRevocationMaterial
• stapling.policyRequiresCapture
• stapling.windowHours

Every value is a bounded measurement or pointer; no token bytes, trust material or credentials appear in evidence.

Common causes

• The local TSA embeds no OCSP/CRL material in its tokens (true of the compose-internal dev TSA).
• Capture was required but the revocation source was unreachable at issuance.

Configuration

This installation view needs an issuance-versus-capture summary from the Evidence database; the reader for it is not composed yet, so the check reports unavailable with reason source-not-configured. The tenant-scoped view of the same fact is served today by the missing-stapling tenant check.

How to verify

The 17 installation checks are served by evidence-web on the shared doctor-check/v1 path and need the ops.health scope. Probe the service DIRECTLY from inside the estate network: the gateway’s unprefixed /doctor/evidence/checks resolves to whichever service registered that template first, not to Evidence.

curl -sS -H "Authorization: Bearer $OPS_HEALTH_TOKEN" \
  http://evidence-web.stella-ops.local:8080/doctor/evidence/checks \
  | jq '.checks[] | select(.checkId == "doctor.evidence.timestamp.revocation.stapling-present")'

Once the Evidence doctor registration is activated (it is off by default in a sealed estate), the same result is also visible through the Platform doctor aggregator under the evidence service.

Related checks

• Token Missing Revocation Material (doctor.evidence.timestamp.evidence.missing-stapling)
• OCSP Responder (doctor.evidence.timestamp.revocation.ocsp-responder)

This is a local evidentiary classification of the token and issuing service at the stated time. It is not the output of a qualified validation or qualified preservation service and does not determine the legal effect of the underlying release, document, or transaction.