docs: verifying a record after the freshness window (informative)

[ogasurfproject-jpg]

Adds an informative page, docs/verifying-after-the-freshness-window.md, as suggested by @imran-siddique in Discussion #47: a docs PR beside the transparency member, built on replay at a pinned now in docs/verification-outcome-statements.md and on the anchors in trace-registry, implementation-neutral.

Problem. Section 3.2.2 refuses a record older than the maximum age and measures against the issuer's iat. That is right for admission and leaves nothing to check a record against weeks later (audit, dispute, incident review).

What the page says. A separate, historical check: hold the record, the trusted key, the inclusion proof and the freshness bounds; establish T from a Registry Anchor Format v1 inclusion check without contacting the issuer; replay only the freshness comparison at T; retain everything as "Retaining one verification call" describes. It gives the bounded statement replay supports (signature verifies, the anchored bytes existed no later than T, iat lies between T minus the maximum age and T plus the skew), the non-claims (the record's claims, the exact signing time, key revocation, which section 3.2.3 places by entry order rather than time, and the independence of ts, which the batch producer writes and which can be the issuer), and the cases where there is no bound or the check fails, including a replay that fails on age only because anchoring lagged.

What it does not do. It changes no schema field, wire format, required claim or conformance requirement, has no uppercase RFC 2119 keyword, and states that a replay at T is not a conformant section 3.2.2 verification at the present time. No implementation is named. The open retention question stays where section 3.1.2 and trace-tests#92 put it.

Other edits. One nav entry in each of the two lists in mkdocs.yml, one line under Related in verification-outcome-statements.md, and one sentence under "SCITT-anchored records" in verification.md pointing to the page.

Checks. python tools/check_dashes.py passes. The docs build the way docs.yml assembles them (mkdocs build --config-file .mkdocs_build.yml) with no new warning, and every in-page and cross-page anchor the new page uses resolves in the built site (20 of 20). This is a docs-only change, so no test can observe it; I did not run pytest locally.

Independent reader. Before opening this, the page and the cited sources (the two docs pages, spec/trace-v0.2.md, spec/registry-anchor-v1.md, CONTRIBUTING) were read by a fresh AI agent session that had seen none of the drafting. It found eight problems, all changed: the revocation bullet treated revocation as a time question, which contradicts section 3.2.3; the draft said every appraisal step runs as at T, when only the freshness comparison moves; "without changing any rule" hid that replay at T is not a section 3.2.2 verification now; the success statement was imprecise about what iat is bounded to; ts was described as written by the registry, when section 4 has the batch producer write it, possibly the issuer; the inclusion proof was missing from the inputs; a failure on age alone was not covered; and "the earlier bound is tighter" invited choosing a bound after the fact, now "replay at each bound and report each". It also suggested citing section 3.1.2 instead of open question 3 for retention, noting that Level 2 appraisal cannot complete when the entry is unreachable, the envelope-profile caveat, and the link from "SCITT-anchored records"; those are in.

Related work, for context only. The intake that prompted the question now runs against the 33 vectors in trace-tests tests/vectors with a stated expectation per file, all as expected; the results are on Discussion #47.

If any sentence reads stronger than the cited text supports, I would rather change it than defend it.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.