From eaf5b28884d47dd8b91969f326a8277d958b8ab6 Mon Sep 17 00:00:00 2001 From: Glenn Gore Date: Sun, 4 Oct 2026 07:02:46 +0200 Subject: [PATCH] chore: release 0.4.0 Bump the workspace to 0.4.0, update the intra-workspace version requirements, and move Unreleased to [0.4.0] - 2026-10-04 with a summary of the major and breaking changes. Signed-off-by: Glenn Gore --- CHANGELOG.md | 68 +++++++++++++++++++++++++++++++++++++++++ Cargo.lock | 6 ++-- Cargo.toml | 4 +-- openvtc-core/Cargo.toml | 2 +- 4 files changed, 74 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 213f217e..d473bfe1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,74 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [0.4.0] - 2026-10-04 + +The vetted-admission release. A person can now join a community by being +vetted by its existing members, and those members can run the vetting from +OpenVTC. The detailed entries follow the summary below. + +### Major changes + +- **Vetted admission (peer identity vetting).** There is a new **Vetting** + page with two tabs: + - **Applications** (applicant side): read a community's requirements before + disclosing anything, ask vetters with a ticket, run a session that shows a + match code, send a signed Vetting Card built from a persona face, collect + `vetted/1` statements against a checklist, and submit once. + - **Vetting desk** (vetter side): requests, tickets with QR links (desk mode + included), a guided session, issued statements, and withdrawal through the + community. + + Vetters are named by their community's `vetter` role credential, which + applicants verify and check for revocation before they spend time on a + session. There is a vetter registry (find vetters, and publish your own + profile), community branding, and an opt-in hidden-vetter mode + (`openvtc-vetting-pcs`) for communities that publish it (#294–#297, #302, + #325, #355, #358). +- **A guided join.** Joining a community that vets offers every way in at + once: start an application, join anyway, or cancel. A persona and a face can + be made without leaving the flow. Requirements are read from the endpoint the + community publishes, a community's questions are answered through a + disclosure, and you can apply as a second persona. The join speaks + `join-requests` 0.3 and falls back to 0.2 (#342–#359, #365, #412). +- **DTG Credentials v1.** Every credential conforms to DTG Credentials v1 and + the DTG VSC predicate registry: role VACs, `vetted/1` and `witnessed/1` + statements, and `issuerScope`. The community's own identity check is kept as + a `vetted/1` and offered as personhood evidence (#397, #408). +- **Personas, faces and worlds.** One **My Identity** pane covers your own + identity. It shows what each face presents, masks sensitive facts, and lets + you make a face for a community, retire and reinstate faces, and see where a + face has been shown (#275–#290, #362, #367–#370, #378). +- **Communities.** + - Each community can live in its own VTA context. + - A membership can be renewed from the Communities view. + - An approved join whose credential never arrived can be rescued. + - Rejection and removal reasons are kept and shown. + - A Repos panel covers a community's git namespaces (#298, #301, #334, + #377–#391, #398, #406, #411). +- **Security.** Every Trust Task request is signed as the persona. Issued + credentials are verified before they are stored. Decisions about who said + something rest on a proof, not on the sender, and documents whose specs + require a proof now carry one (#371, #380–#390). +- **Transport and setup.** TSP Rev 3 is supported throughout, including joins, + leaves and later traffic over TSP. An account can be rebuilt from what the + VTA holds, and setup recovers an existing Trust Context instead of + overwriting it (#247–#250, #333, #413, #415). +- **TUI.** Built-in, custom and imported themes, with live switching, + automatic light/dark, accessible themes and `NO_COLOR` (#299, #300). + Network-bound checks no longer freeze the screen. + +### Breaking + +- **Credentials stored in a pre-v1 shape are set aside on load** and listed as + retired. Ask the peer or community to issue fresh ones (#397). +- **Relationship credentials are issued under the relationship DID**, not the + persona DID (#255). +- **What a community may call a face is now kept and shown**, which changes the + stored persona records (#362). +- Peers and communities must speak the signed Trust Task forms this release + sends. Unsigned requests and replies taken on the sender's word are refused. + ### Added - **Joining speaks `join-requests` 0.3 and 0.2.** A community on VTI-13 diff --git a/Cargo.lock b/Cargo.lock index 6d0c9a80..07640ba2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -6277,7 +6277,7 @@ dependencies = [ [[package]] name = "openvtc" -version = "0.3.1" +version = "0.4.0" dependencies = [ "aes-gcm 0.11.1", "affinidi-data-integrity", @@ -6338,7 +6338,7 @@ dependencies = [ [[package]] name = "openvtc-core" -version = "0.3.1" +version = "0.4.0" dependencies = [ "aes-gcm 0.11.1", "affinidi-data-integrity", @@ -6403,7 +6403,7 @@ dependencies = [ [[package]] name = "openvtc-vetting-pcs" -version = "0.3.1" +version = "0.4.0" dependencies = [ "ark-bls12-381", "ark-ec", diff --git a/Cargo.toml b/Cargo.toml index 31db26cb..04c5dd39 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,7 +9,7 @@ resolver = "3" [workspace.package] description = "Open Verifiable Trust Community (OpenVTC) - First Person Protocol" -version = "0.3.1" +version = "0.4.0" edition = "2024" publish = true authors = ["Glenn Gore "] @@ -19,7 +19,7 @@ license = "Apache-2.0" repository = "https://github.com/OpenVTC/openvtc" [workspace.dependencies] -openvtc-core = { version = "0.3", path = "openvtc-core", default-features = false } +openvtc-core = { version = "0.4", path = "openvtc-core", default-features = false } # Decentralized Trust Graph Credentials. # diff --git a/openvtc-core/Cargo.toml b/openvtc-core/Cargo.toml index 60db55bc..b8388fff 100644 --- a/openvtc-core/Cargo.toml +++ b/openvtc-core/Cargo.toml @@ -26,7 +26,7 @@ arbitrary = ["dep:arbitrary", "chrono/arbitrary"] [dependencies] # Hidden-vetter admission (ZKP). Published from this workspace before this # crate; its version moves with the workspace version. -openvtc-vetting-pcs = { version = "0.3.1", path = "../openvtc-vetting-pcs" } +openvtc-vetting-pcs = { version = "0.4.0", path = "../openvtc-vetting-pcs" } aes-gcm.workspace = true anyhow.workspace = true