CR-133: Report terminal revocation as healthy-as-revoked (implementation slice) - #178

Implements the CR-133 accepted option (a) semantics under the single-slice
implementation-authority grant recorded on 2026-08-14, bounded to the four-file
allowlist.

LifecycleHealthy != OperationallyUsable != CapabilityReady

Recorded pre-change behavior

Measured read-only against main@770d9f2 for a revoked identity:

$ tc identity doctor agent-001          # exit 1
ERROR   no_active_key
WARNING missing_rotated_at
WARNING missing_archived_key

The two warnings were structurally unreachable as true: revoke_identity()
neither stamps rotated_at nor archives key material, so a revoked record was
being measured against rotation-shaped expectations it can never satisfy.

Why both surfaces change together

A change confined to check_health() would have introduced a worse defect. The
--for-capability loop skips any agent without exactly one active identity, and
the process exits non-zero only when the report has errors. Today's non-zero exit
for a revoked agent comes entirely from no_active_key. Removing it alone makes
tc identity doctor <revoked> --for-capability X exit 0 in silence — emitting
neither a capability error nor a readiness line — reporting success for an identity
the accepted semantics state is not capability-ready.

Approach

A shared module-level predicate, is_terminal_revoked(), classifies the accepted
state narrowly — zero ACTIVE_STATUS, exactly one REVOKED_STATUS, every
remaining record ROTATED_STATUS. Both check_health() and tc_identity_doctor()
consume it, so the two surfaces cannot drift apart on the classification.

Reachability of the refused shapes was probed rather than assumed: multiply-revoked
is unreachable through supported commands (identity init refuses an existing
agent_id), and COMPROMISED_STATUS has no production writer. Both are hand-edit
only, and both keep their current findings.

--for-capability fails via a distinct revoked_identity_not_capability_ready
code. Reusing missing_requested_capability would assert the capability is absent
when revocation is the operative reason — a different and often false fact. The
message claims nothing about whether the capability was ever granted, so it holds
for both the granted and never-granted cases.

The revoked state is stated positively rather than merely non-erroring, so a bare
Identity doctor passed cannot be misread as "this signer is ready":

OK lifecycle_state=revoked agent_id=agent-001 fingerprint=<fp> operationally_usable=false capability_ready=false

Constraints preserved

• ROTATED_STATUS historical-integrity diagnostics intact — proven by a test that
  deletes the archive on a rotated-then-revoked agent and asserts the warning still
  fires against the rotated fingerprint and not the revoked one
• COMPROMISED_STATUS health behavior unchanged through both the zero-active and
  historical-record paths. The historical guard stays a negative exemption rather
  than being rewritten to status == ROTATED_STATUS, and suppression is conditioned
  on terminal revocation rather than on "no active identity" — the two vectors
  CR-133 names
• no_active_key intact for every other zero-active cause
• Revoked identities remain unusable for signing, verification, authorization, and
  capability readiness — verify_signed_payload() and
  require_authorized_capability() untouched
• IdentityDoctorReport, IdentityDoctorIssue, revoke_identity(), and
  check_consistency() unchanged
• No private-key retention, archival, or deletion policy introduced or inferred

Verification

Full suite: 1718 passed, 6 skipped. Nine new cases in tests/test_doctor_cli.py
cover the CR's four required regression cases plus a compromised-state behavioral
non-change proof, a parametrized guard against widening the predicate, a read-only
guarantee on the revoked path, and narrow check/doctor non-contradiction for the
revoked state only.

Scope

Independent of PR #177, which adds only the CR document — no file overlap. This
branch is based at origin/main@770d9f2.

The grant covers preparation of this reviewable candidate only. It does not carry
implementation acceptance, merge, release, or closeout authority. The four deferred
archived-design coverage gaps remain outside this slice.

🤖 Generated with Claude Code