Technical note — Residual Trust Assurance
Why identity providers cannot prove residual access is gone
Control-plane revoked is not data-plane proof. LingerCut probes are least-harm: we never replay actions that create business side effects. GitHub PATs are proved by absence re-list, not by using the token to clone or push. Entra, Okta, AWS, and GitHub already revoke. Necessary. Not proof. A kill receipt is VALID only if a least-harm replay of the old session, grant, or token fails — never because a vendor said revoked:true.
Claim vs evidence
After a leak or a password rotation, the IdP console goes green. The revoke API returns success. The board is told leftover access is gone. Then someone presents the old PAT, refresh token, or browser session — and it still works.
That is the measurement gap. Password managers store the next secret. IdPs prove the next login. EDR watches the endpoint. SSPM inventories the config. None of them adversarially replay the old grant and require failure.
Why the IdP cannot close the loop
If Okta is in the blast radius, Okta cannot be the only verifier of leftover Okta trust. Same for Entra, GitHub, and AWS. The control plane that issued the grant is the same plane that reports it revoked. That report is a vendor flag, not an independent bounce.
LingerCut cuts out-of-band, then probes from a plane that is not the possibly stolen session. We record the vendor flag. We do not trust it.
What we measure
VALID means the replay bounced (or an absence re-list no longer shows the grant). WITHHELD means the leftover is still live — even if every vendor API is green. Transport failure is a probe error, not a fake WITHHELD. HMAC on the receipt is integrity of the bytes, not the liveness check.
GitHub PATs are proved by absence re-list, not by using the token to clone or push. Mutating probes cannot mint VALID.
Hold the sample, then ask for evidence
The public lab mints signed sample receipts on LingerCut-controlled leftovers lc_gt_01 (bounce) and lc_ms_02 (false green). That is a walkthrough of the schema — not a production kill of your tenant. Paste a real signed receipt at /verify. If the last time an IdP said revoked your evidence was a checkbox, that is not a kill receipt.