In October, Bitgrit, acting as an independent operator for the Identity & Trust Working Group of the Agentic AI Foundation (AAIF), ran four scenarios against MintID: our published test harness, at a release they pinned, on our public testnet and on a local node of their own. They published the raw events, the timings and the checksums. This is the first time someone outside the project has executed our revocation tests and published what they saw.
It is not an audit. Nobody reviewed our code or our cryptography, and nothing here certifies anything. It is an external test round: an independent party, a published method, evidence anyone can re-check.
What was run. The working group compares how different systems decide whether an agent may act, and what happens when the authority behind it changes or disappears. Bitgrit ran four cases against release public-v2026-10-17.1, each with an agent holding a bounded agent credential and asking to initiate a payment of 5 USDC. No money moved: with MintID, the verifier decides whether the agent may act, and the record marks every effect beyond that decision as not applicable.
- An action outside the agent’s delegated scope. The agent’s holder refused to produce a proof for it, and a presentation forced through anyway was rejected by the verifier. The record calls this a scope refusal at the decision gate, inside the scope the principal (the verified person behind the agent) fixed when the agent was minted. A veto enforced at the system that would carry out the action is marked not applicable, because MintID does not reach that system.
- A revoked credential. After the issuer revoked the agent, no presentation was accepted; the first refusal came 11.0 seconds after the revocation, against a bound of 185 seconds.
- The authority unreachable. On Bitgrit’s local node, the chain was cut for 40.1 seconds. The verifier refused while it could not prove the issuer’s state (it answers “state unavailable” rather than guessing), and accepted again 1.2 seconds after the node came back.
- The kill switch. The holder’s kill switch revokes the agent credential’s authority; it does not stop the agent’s software. After it was pulled, one presentation was still accepted 27.5 seconds after the chain recorded the switch-off, and the first refusal came at 33.8 seconds. The bound is 245 seconds, about four minutes.
What it means. With MintID, the decision is taken at the moment of the presentation: a relying party asks, the agent proves, the verifier answers. MintID does not reach into a payment or an action that has already been carried out, so the working group’s case “revocation after dispatch” does not apply at our boundary. The kill-switch run measures something narrower and still useful: how quickly a revocation reaches every verifier. That is not instant. A revocation travels in the issuer’s next status root (a small signed summary the issuer publishes on the chain, saying which credentials are still valid), and until that root is final a verifier can still accept a presentation, within a stated bound. The numbers above are observations from one run by someone other than us; what we guarantee is the bound.
The record, corrected. Bitgrit’s first record, of 19 October, left three entries open to a broader reading than MintID claims: a veto at the executor in the scope case, a hold on an action already dispatched in the kill-switch case, and the amount, written in minor units, read as five million USDC. We posted a correction on the working group’s thread on 20 October. The same day Bitgrit published Reporting Revision 2 of the record (SHA-256 54bafef8…cdc2), which states those three entries as above and keeps the original evidence byte-identical, and Vlad Kostitsyn checked its digest and its cells on the thread.
What went wrong, on our side. Three hours after Bitgrit pinned their versions on 13 October, we moved the testnet’s services to a newer release. That release changed how an agent’s key custody is appraised, and the test script at their pinned version could no longer get past its first check. Bitgrit reported it; the round decided to keep that attempt on record as blocked and to re-pin to public-v2026-10-17.1, the release the testnet ran for the rest of the round. The round’s organisers recorded our testnet moves as a deviation from the pinned versions, and they are right to. We locked the testnet at that release until the round’s formal end on 30 October, and we are making that a rule: while an external round runs, releases go to the package registries only, and any move of the testnet is announced first.
Where the round stands. Round 1 closed in substance on 20 October 2026, with Reporting Revision 2; its formal end date is 30 October. Hiroshi Yamakawa, writing for ALIGN on the working group’s list, described the round as complete and scoped as agreed. A second round, if there is one, will run on published terms. If it does, we would like it to cover a custody check with real key attestation, a node started by the operator from our published genesis, production parameters, and the agent-to-agent handshake.
Check it yourself. Bitgrit’s record and evidence are public: the comparison record and Reporting Revision 2 on the working group’s thread (github.com/aaif/wg-identity-and-trust/issues/13), the operator’s evidence bundle and checksums (aaif-direct.bitgrit.net), and the discussion of the pins (github.com/agentrust-io/integrations/issues/287). Our harness is in the public repository at the pinned tag, and anyone can run it against the public testnet.
Disclosure: MintID is built by Conectia OÜ (trading as Conectia PRO), the company of MintID’s founder and a related party, which also operates the public testnet. Bitgrit’s own disclosure in the record reads: “Role: independent operator; Bitgrit submits no implementation. Disclosure: Bitgrit develops DID/VC identity infrastructure.”