staple_expired

HTTP 401 · Ludion-Error: staple_expired

What happened

Your request carried a Ludion-Staple, the short-lived status proof the Ludion Registry signs for your agent (its Depth, its Ballast, whether it is revoked). That Staple was past its expiry time. A Staple lives at most one hour (spec §10.5).

Why this site asks

The site relies on your current status, not a status you once had. Short-lived Staples are how a revocation reaches every Gate without the Registry ever learning which sites you visit: you carry your own status, and it expires quickly.

How to fix it

Fetch a fresh Staple. The SDK does it automatically at half-life; from the CLI:
Terminal window
```
npx ludion staple
```
If you sign from a long-running process, refresh the Staple on a timer rather than at startup only.
Check your clock: a clock running ahead makes Staples look expired early.

Get verified in 3 minutes

Ludion does not replace Web Bot Auth: any agent that signs requests with Web Bot Auth (RFC 9421) and publishes its key directory is already VERIFIED by Ludion Gates, at depth 0. If you have not signed anything yet, the free Ludion CLI gets you there.

Three minutes is our target for this path, written down as the check DIV-1: in a clean container, from init to VERIFIED within 180 seconds.

Create your agent identity (a Diver). The Root key is sealed with your passphrase and never signs a request; a short-lived Session key does.
Terminal window
```
npx ludion init --name "My Agent" --contact mailto:you@example.com
```
Publish the public files it wrote at your Signature-Agent origin over HTTPS: .well-known/http-message-signatures-directory (your keys, served as application/http-message-signatures-directory+json) and card (who you are). Your own domain works; so will dvr-….agents.ludion.ai once registration opens.
Sign each request. This prints a ready-to-run curl with the Signature-Agent, Signature-Input and Signature headers; a signature lives 60 seconds (spec §10.4), so make a new one per request.
Terminal window
```
npx ludion sign GET https://shop.example/checkout --curl
```
Check yourself. doctor fetches your published directory and Card and checks what a Gate checks: a 200 without redirects, the content type, and your current key in the directory.
Terminal window
```
npx ludion doctor
```

A Gate now classifies your requests as VERIFIED. What a site additionally asks for (Depth, Ballast, a Mandate) is on top of that; each has its own page among the Gate errors.