Hello OAuth WG participants, Thank you to Thilina, Jeff, Caleb, and Jiahui for the constructive feedback. I appreciate the references to existing signaling and authorization mechanisms, the bounded settlement-window proposal, and Jiahui's procurement example.
The supplier example makes a distinction worth testing rather than resolving prematurely in normative text: (a) work still queued locally and subject to cancellation, (b) an externally accepted obligation that can only settle or be compensated according to preexisting policy, and (c) a downstream path for which acceptance or enforcement state cannot be established. I agree that a useful negative test should distinguish those cases and should not treat UNKNOWN as CLOSED. I also agree that permitted settlement of an already-accepted obligation must not automatically be misreported as unauthorized post-revocation use. Whether a documented permitted-settlement outcome is a named sub-state of CLOSED, a separate outcome, or PARTIAL with an annotation remains an open semantics question; I am not proposing to settle that by email. For a minimal, implementation-neutral test vector, which evidence would a relying party need to distinguish an external party's acceptance before revocation from merely queued internal work, and what evidence could establish the settlement policy and its effective window? Examples identifying unobservable or non-interoperable cases are especially welcome. I will examine the existing standards and prior-art pointers before proposing any revisions. This continues to be discussion of an individual Internet-Draft; no WG adoption, consensus, new protocol object, or claim of independent validation is implied. Regards, Deonté O’dell Watts Independent Researcher | GoodShyt Group Inc. ORCID: 0009-0005-8586-3650 _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
