Expand description
Token revocation list kept in the harness state store (pillar 1).
With state_backend = "redis", every replica reads the same list, so a
token revoked through one replica is refused by all of them on the next
request. The single-process backend keeps
av_identity::InMemoryRevocationStore instead, whose sweep bounds its
memory; see agentvisord’s startup wiring.
Structs§
- Guarded
Revocation Store - Fail-closed protection for distributed revocation storage. Only confirmed revocations and locally requested revocations are cached. A successful “not revoked” answer is never cached, so replicas see later revocations on the next request. Failed writes still return errors to their callers.
- State
Revocation Store - Revocation list backed by a
StateStore. Each revoked JTI is one counter; the Redis backend expires it 24 h after the write, far past the 15-minute NHI lifetime, so the list cleans itself up.