checkId: doctor.evidence.timestamp.evidence.missing-stapling family: doctor-check/v1 service: evidence-web scope: tenant severity: warning tags: [timestamping, evidence, revocation, stapling, tenant]

Token Missing Revocation Material

Stella Ops is self-hosted software. It does not issue electronic time stamps or provide any qualified trust service. This deployment performs local verification using operator-supplied evidence. Unless an approved jurisdiction-, provider-, service-, and deployment-specific claim profile applies, qualified status is not determined.

Reports the tenant’s parsed tokens that carry no OCSP response or CRL for their signer. Long-term validation of such a token depends on material that must be fetched later, while it is still available. Default severity when it fails: warning. Tenant-scoped: one result per tenant under that tenant’s row-level security, recorded by the worker schedule tenant-evaluation (hourly) and on demand through the Timestamp Assurance API.

What it measures

Fails with the count when any parsed token lacks embedded revocation material.

The check never reports a pass for a value it does not have. When its source cannot be read it reports unhealthy with the message Source unavailable (<reason>): <detail>. No verdict can be reported. and the evidence keys source.state=unavailable, source.reason (one of source-not-configured, source-configuration-invalid, unavailable-by-sealed-policy, source-material-invalid, source-read-failed) and source.detail.

Evidence keys

inventory.tokenCount
missingStapling.missingCount
missingStapling.missingBundles

Every value is a bounded measurement or pointer; no token bytes, trust material or credentials appear in evidence.

Common causes

The TSA does not staple revocation material into its tokens.

Configuration

No threshold. On the lab estate every token the compose-internal TSA issues lacks stapled material, so this check reports 9 of 9 there; that is a true statement about the TSA, not a defect in the check. Missing stapling is a warning and not a re-timestamp trigger.

How to verify

The five tenant checks are evaluated for the caller’s tenant only, under that tenant’s row-level security, and served by the Timestamp Assurance API through the gateway (evidence:read; a fresh run needs evidence:create). The worker also records a run per tenant every hour under the key schedule:tenant-evaluation:<bucket>.

# Latest recorded run for your tenant
curl -sS -H "Authorization: Bearer $EVIDENCE_READ_TOKEN" \
  https://stella-ops.local/api/evidence/v1/timestamp-assurance/status \
  | jq '.checks[] | select(.checkId == "doctor.evidence.timestamp.evidence.missing-stapling")'

# Evaluate now (idempotent on the key; a replay returns the same run)
curl -sS -X POST -H "Authorization: Bearer $EVIDENCE_CREATE_TOKEN" -H "Content-Type: application/json" \
  -d '{"idempotencyKey":"manual:'"$(date -u +%Y%m%dT%H%M%SZ)"'"}' \
  https://stella-ops.local/api/evidence/v1/timestamp-assurance/runs

Revocation Material Stapled at Issuance (doctor.evidence.timestamp.revocation.stapling-present)
OCSP Responder (doctor.evidence.timestamp.revocation.ocsp-responder)

This is a local evidentiary classification of the token and issuing service at the stated time. It is not the output of a qualified validation or qualified preservation service and does not determine the legal effect of the underlying release, document, or transaction.