Certificate expiry is an operational event

What the public implementation shows

Guevara includes certificate retrieval, validation services, expiry notification configuration, background workers, and certificate administration commands.

The control plane governs visibility and lifecycle while participant systems continue to use certificates for message trust. This is the implementation fact behind the note; the architectural reading begins from that visible boundary rather than from an assumed production story.

Operating principleA certificate is healthy only when its replacement path is visible before expiry.

The decision behind the mechanism

Scheduled validation and notification turn expiry into planned operational work instead of a payment-path surprise.

A certificate can be cryptographically valid today but close enough to expiry that an unattended weekend creates a participant outage. The mechanism matters because it gives that failure a named boundary, durable evidence, and a controlled response instead of leaving the outcome to timing or operator guesswork.

• Validate certificate dates and expected participant identity.
• Notify at multiple lead-time thresholds.
• Record retrieval and validation failures separately.
• Confirm replacement before retiring prior material.

How the control should be operated

The inventory should retain participant, issuer, serial, validity dates, retrieval source, owner, notification stages, and replacement status.

Operations can manage trust continuity across all participants from one governed surface. The reusable lesson is not to copy a class or endpoint in isolation, but to preserve the relationship between identity, state, authority, evidence, and operational ownership.