checkId: doctor.evidence.timestamp.tsa.root-expiry family: doctor-check/v1 service: evidence-web scope: installation severity: warning tags: [timestamping, tsa, trust-anchor, expiry, evidence]

TSA Trust Anchor Expiry

Stella Ops is self-hosted software. It does not issue electronic time stamps or provide any qualified trust service. This deployment performs local verification using operator-supplied evidence. Unless an approved jurisdiction-, provider-, service-, and deployment-specific claim profile applies, qualified status is not determined.

Reports the remaining validity of the soonest-expiring trust anchor the TSA chains to, read from the validated trust material (a PEM anchor file online, the signed OfflineKit trust bundle sealed). The anchor that lapses first decides the posture: the chain stops being buildable the moment it does. Default severity when it fails: warning. Installation-scoped: one result per estate, served on the Evidence doctor path and probed on the worker schedule chain-posture (daily).

What it measures

The check never reports a pass for a value it does not have. When its source cannot be read it reports unhealthy with the message Source unavailable (<reason>): <detail>. No verdict can be reported. and the evidence keys source.state=unavailable, source.reason (one of source-not-configured, source-configuration-invalid, unavailable-by-sealed-policy, source-material-invalid, source-read-failed) and source.detail.

Evidence keys

Every value is a bounded measurement or pointer; no token bytes, trust material or credentials appear in evidence.

Common causes

Configuration

Trust material never comes from a configured date or a bare URL. Online estates may point the TSA path at a PEM anchor file (Evidence__TimestampAssurance__Adapters__TrustAnchorBundlePath); a sealed estate mounts the OfflineKit timestamp-trust-bundle/v1 artifact, which is signature-verified before any part of it is read:

Evidence__TimestampAssurance__TrustBundle__BundleDirectory: "/mnt/offline-kit/timestamp-trust-bundle"
Evidence__TimestampAssurance__TrustBundle__Anchors__0__KeyId: "offline-kit-2026"
Evidence__TimestampAssurance__TrustBundle__Anchors__0__PublicKeyPemFilePath: "/mnt/offline-kit/keys/offline-kit-2026.pub"
Evidence__TimestampAssurance__TrustBundle__AcceptedProducers__0: "stellaops-offline-kit"
Evidence__TimestampAssurance__TrustBundle__RequiredRevocationKinds__0: "crl"

With a bundle configured, trust anchors and the revocation snapshot are answered from the artifact and the TSA-path measurements from the local responder; a bundle that fails validation makes every artifact-dependent check unavailable with reason source-material-invalid and the rejection code as detail. A replaced artifact is re-read within a minute.

Thresholds live in Evidence__TimestampAssurance__Policy__* and default to the values the retired Doctor plugin used (carried verbatim so a cadence or threshold change is always a visible edit).

How to verify

The 17 installation checks are served by evidence-web on the shared doctor-check/v1 path and need the ops.health scope. Probe the service DIRECTLY from inside the estate network: the gateway’s unprefixed /doctor/evidence/checks resolves to whichever service registered that template first, not to Evidence.

curl -sS -H "Authorization: Bearer $OPS_HEALTH_TOKEN" \
  http://evidence-web.stella-ops.local:8080/doctor/evidence/checks \
  | jq '.checks[] | select(.checkId == "doctor.evidence.timestamp.tsa.root-expiry")'

Once the Evidence doctor registration is activated (it is off by default in a sealed estate), the same result is also visible through the Platform doctor aggregator under the evidence service.

This is a local evidentiary classification of the token and issuing service at the stated time. It is not the output of a qualified validation or qualified preservation service and does not determine the legal effect of the underlying release, document, or transaction.