Dusk Foundation breaks workflows when a credential refresh lands mid-flight and the chain refuses to “grandfather” anything.
The wallet can still sign. The participant still exists. The problem is narrower and meaner: the verifiable credential that qualified the call is no longer the credential that qualifies the state transition at execution time.
On a lot of stacks, that mismatch gets papered over by habit. Sessions are treated as sticky. If the counterparty passed checks ten minutes ago, operators behave as if they’re still inside the same access envelope. The transfer clears, someone annotates later, and the system moves on.
Dusk doesn’t give you that slack.
If the flow is Moonlight-routed, identity-aware execution is part of the path, not a compliance wrapper you apply after settlement. The state transition asks the credential question when it actually moves state. If the credential set rotated, narrowed, or refreshed between preparation and execution, the “same user” is irrelevant. The context changed. The chain evaluates the context, not the story.
So the transaction just stops where it should have closed.
No drama. No partial. No “accepted when submitted.” Finality doesn’t land because the condition that permits movement isn’t true anymore. The ugly part is that nothing looks broken enough to satisfy people who are waiting. Validators aren’t misbehaving. Fees aren’t spiking. DuskDS is producing blocks. You’re stalled because access moved while everyone assumed access was inert.
Privacy makes it harder to manage without turning it into a trust exercise.
There isn’t a public trace you can hand around to prove the mismatch. There’s no mempool theater to blame. From the outside, you get silence. Inside, you get a hard refusal rooted in identity gating that won’t widen scope to calm the call.
This hits automation first.
Anything that chains actions under one assumed credential context starts failing in a way that looks random until you map timing precisely: credential refresh at T, execution at T+Δ, denial at the boundary. Humans can re-run, re-authorize, re-present. Systems break, because they were built on a soft assumption Dusk refuses to honor.
The pressure isn’t “identity is hard.” The pressure is that Dusk treats identity as live state, not a static permission slip. If the credential changed, you’re not “almost eligible.” You’re not eligible. The chain waits for a qualifying credential to be presented again under the current context, and everything downstream waits with it. #Dusk $DUSK @Dusk
