checkId: doctor.evidence.timestamp.evidence.token-expiry family: doctor-check/v1 service: evidence-web scope: tenant severity: warning tags: [timestamping, evidence, token, expiry, tenant]

Token Signer Expiry

Stella Ops is self-hosted software. It does not issue electronic time stamps or provide any qualified trust service. This deployment performs local verification using operator-supplied evidence. Unless an approved jurisdiction-, provider-, service-, and deployment-specific claim profile applies, qualified status is not determined.

Examines the signer certificate embedded in each of the tenant’s stored tokens: critical when a signer has already expired (the chain can no longer be rebuilt at the current instant), warning when one expires inside the warn window, and a warning when tokens carry no signer certificate at all. Default severity when it fails: warning. Tenant-scoped: one result per tenant under that tenant’s row-level security, recorded by the worker schedule tenant-evaluation (hourly) and on demand through the Timestamp Assurance API.

What it measures

Critical with the count when any signer notAfter is in the past.
Warning when any signer expires within TokenSignerExpiryWarnWindow (default 180 days).
Warning when parsed tokens carry no signer certificate and none can be judged.

The check never reports a pass for a value it does not have. When its source cannot be read it reports unhealthy with the message Source unavailable (<reason>): <detail>. No verdict can be reported. and the evidence keys source.state=unavailable, source.reason (one of source-not-configured, source-configuration-invalid, unavailable-by-sealed-policy, source-material-invalid, source-read-failed) and source.detail.

Evidence keys

inventory.tokenCount
tokenExpiry.warnWindowDays
tokenExpiry.expiredCount
tokenExpiry.expiringCount
tokenExpiry.withoutSignerCertificateCount
tokenExpiry.expiredBundles
tokenExpiry.expiringBundles

Every value is a bounded measurement or pointer; no token bytes, trust material or credentials appear in evidence.

Common causes

The TSA rolled its signer and old tokens still chain to the retired key.
Tokens were minted without an embedded signer certificate.

Configuration

Thresholds live in Evidence__TimestampAssurance__Policy__* and default to the values the retired Doctor plugin used (carried verbatim so a cadence or threshold change is always a visible edit).

An already-expired signer IS a loss-of-verifiability event: the daily planning schedule enqueues such tokens for re-timestamping (reason token-expiring). The 180-day warning is not a trigger.

How to verify

The five tenant checks are evaluated for the caller’s tenant only, under that tenant’s row-level security, and served by the Timestamp Assurance API through the gateway (evidence:read; a fresh run needs evidence:create). The worker also records a run per tenant every hour under the key schedule:tenant-evaluation:<bucket>.

# Latest recorded run for your tenant
curl -sS -H "Authorization: Bearer $EVIDENCE_READ_TOKEN" \
  https://stella-ops.local/api/evidence/v1/timestamp-assurance/status \
  | jq '.checks[] | select(.checkId == "doctor.evidence.timestamp.evidence.token-expiry")'

# Evaluate now (idempotent on the key; a replay returns the same run)
curl -sS -X POST -H "Authorization: Bearer $EVIDENCE_CREATE_TOKEN" -H "Content-Type: application/json" \
  -d '{"idempotencyKey":"manual:'"$(date -u +%Y%m%dT%H%M%SZ)"'"}' \
  https://stella-ops.local/api/evidence/v1/timestamp-assurance/runs

TSA Signer Certificate Expiry (doctor.evidence.timestamp.tsa.cert-expiry)
Re-timestamp Work Pending (doctor.evidence.timestamp.evidence.retimestamp-pending)
Evidence Timestamp Staleness (doctor.evidence.timestamp.evidence.staleness)

This is a local evidentiary classification of the token and issuing service at the stated time. It is not the output of a qualified validation or qualified preservation service and does not determine the legal effect of the underlying release, document, or transaction.