CAIN-42 invariant · E28

E28-I51: revoking a parent identity revokes every descendant identity, token and lease

Held · CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity

Last reviewed 2026-10-01

held   niche Evidence, receipts & proofs · family lineage

What this rule means

CAIN-42 must always satisfy: revoking a parent identity revokes every descendant identity, token and lease. It is one of 90 invariants checked for CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

({'identities': ['cid_a44ca199fac6f6ce0b521a95e61d2b2e', 'cid_e58ea534e70362fcca79191d3b6dfc89'], 'tokens': ['dlg_9b04d6f600dfc6b783ff0ff03e6ec530', 'dlg_cbb93a0136f4c9be79b6d0ffa3b07627'], 'leases': ['lse_11f4f912449e5b379a804de7f4c5de87',

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Related rules

• E28-I21: identity envelope signed by another key is refused
• E28-I22: a tampered envelope field is refused on decode
• E28-I23: an envelope for another audience is refused
• E28-I24: an expired envelope is refused
• E28-I25: a session envelope cannot stand in for a transaction envelope
• E28-I26: a transaction envelope cannot live longer than 30 s
• E28-I27: the envelope authority field is always NONE, whatever the issuer is asked
• E28-I31: registration without proof of possession is refused

← E28-I50 · all 90 · E28-I52 →