Permanent credential-revocation failures are silently swallowed, not logged or surfaced (§9.8.2, §14)

[nficano]

Category: spec-conformance Severity: major
Location: lib/arcp/runtime/credential_registry.rb:53-64
Spec: ARCP v1.1 §9.8.2

What

Spec §9.8.2 requires revocation to be best-effort with retry AND that permanent failures be logged; §14 requires unrevocable credentials be surfaced to operators. revoke retries once then returns false with no log; revoke_all just stops counting it. A credential that cannot be revoked leaves spending authority dangling with no operator signal.

Evidence

def revoke(credential_id)
  attempts = 0
  begin
    attempts += 1
    @provisioner.revoke(credential_id: credential_id)
    true
  rescue StandardError
    retry if attempts < 2
    false
  end
end

Proposed fix

Log permanent revocation failures and retain the credential id in the store (already done) plus surface it via a callback/metric so operators can act.

Acceptance criteria

• A provisioner.revoke that always raises produces a logged permanent-failure record and the credential id remains outstanding.