GI3 verdict — revocation

This page records why SOVM-IROH §10 marks GI3 closed. It is a record of evidence, not part of the specification: it adds no requirement, and the gate’s text on the binding page is what it answers to.

1. The gate

GI3 revocation: a revoked node’s connection hard-fails at trust resumption on the next establishment attempt, with TRUST_FAILED observable.

2. Where the evidence was read

• Commit. d6f6a00e0e5ba94a78318401a87d0bd76ded7d6e, on main since the promotion of 2026-09-11. Every test named below exists at that commit.
• Run. CI run 19083, job Rust Test (sovm workspace), 2026-09-08T22:47Z, step cargo test (sovm workspace on loopback), which checked out exactly that commit. Every test named below passed in it. None of them is ignored by default, so the same tests run in that job on every merge.

3. The clauses, and the tests that carry each

Clause	Tests
hard-fail at trust resumption, in one process	gi3_a_revoked_peer_hard_fails_at_trust_resumption_with_trust_failed in sovm-iroh’s gates tests: after the peer is revoked from the keyring, the next establishment fails at trust resumption
across a real establishment, two processes	a_revoked_peer_hard_fails_at_trust_resumption in sovm-run’s two_machines tests: the revoked peer is a separate process with its own store, the establishment is a real dial, and TRUST_FAILED is observable at the requiring node
observable, as a typed class	the failure is asserted on a typed TRUST_FAILED class rather than on message text, and sovm-node --require-trust-failed turns the observation into a run-level assertion
negative control	a_trusted_peer_fails_a_trust_failure_requirement in two_machines: the requirement cannot be met vacuously by a healthy pair

4. The rulings that interpreted the gate

The gate is read on its own text, on both sides of one establishment. The dialling node observed TRUST_FAILED and the refusing node reported the trust failure, after a successful establishment between that same pair had first been demonstrated and then revoked. A peer that was never trusted proves nothing here, and a connection that dropped for another reason satisfies neither side.

The one open question was shared with GI1, and was ruled on 2026-09-08. The two processes run on one kernel. The independence ruling recorded on the GI1 verdict settled it; nothing specific to GI3 was open. The binding page marked the gate closed on 2026-09-11.

5. What the evidence does not show

GI3 is a transport-binding gate: it shows the binding refuses a revoked peer at establishment. It does not close SSP/1’s revocation-announcement gap — how peers learn of a revocation is an open matter of SSP/1 §40.3 — and it does not measure the revocation window that SSP/1 gate GS8 names. Closing GI3 is progress on neither.

6. Reproducibility

The workspace these tests live in is not released, so an outsider cannot re-run them today. Reproducibility is a target, owed under decision D-0002 by project P-0058, which releases the node code the tests exercise; until then this page is a record an outsider can read and not yet one they can check.