Repository navigation
feat: did:scid personas - #503
Merged
Merged
Conversation
…Status (#2196) Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
…a did:scid's locator (VTI-KEY-160 to VTI-KEY-165, VTI-VTA-036)
The account gains `preferred_did_method` and `scid_also_known_as`, both
optional and off the wire when unset: an account that states nothing sends
`vta/webvh/dids/create/1.1` exactly as before and the VTA's `[dids]` decides.
A persona mint goes through `create_did_webvh_presented` with the operator's
choice for that persona (join flow) or the account's preference.
The VTA's `did` is the identity in the applied form, so key ids stay
`{did}#key-N`, which is what a did:scid's own document lists (VTI-KEY-161).
A did:scid persona's DID URL with `src` is recorded on its PersonaRecord as
`did_locator`. It is the persona's ATM profile DID, so what it sends carries
the source a first-contact peer needs (VTI-KEY-163). At load it seeds the
resolver's did:scid sources, so the bare DID resolves after a restart
(VTI-KEY-162). Orphaned-key detection recognises did:scid persona keys.
`create_did_via_server` returns a `MintedDid` rather than a tuple; its unread
mnemonic is dropped.
Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
…e mint choice (VTI-KEY-160, VTI-KEY-163) - Display: `shorten_webvh` elides a did:scid:vh:1's SCID too, keeping its `?src=` locator, where its host and path are. - `validate_did` admits a did:scid DID URL whose only query is `src`, by validating its identity and the locator as a host and path. No other query, and no other method's, is admitted. - Context tokens and rebuilt sub-contexts take a did:scid community's SCID, never its locator, whose `?` and `/` have no place in a context id. Health labels name a did:scid by its `src` path. - Agent names: the host of a did:scid is its `src` host; a bare did:scid has none, so the identity panel carries the persona's locator. - The create-persona overlay (`m` on the path screen) and the join identity choice (`m` on "Be someone new") choose the new persona's form: the account's preference, did:webvh, or did:scid. The worked example follows the choice. A minted did:scid persona is shown and copied as its DID URL with `src`, which is what a community needs to resolve it. - Setup and join examples, and a loading tip, mention did:scid. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
…id:scid persona speaks as its locator (VTI-KEY-161, VTI-KEY-163, VTI-KEY-164) - proof_check: a did:scid signer, and its verificationMethod, may be named with the `?src=` locator its document was resolved through. The document and its keys are under the bare DID, so both are compared without it. The method's DID must still be the signer's, and a did:webvh of the same log is not the did:scid. - A VRC's issuer binding, a picked-up message's authenticated sender, and the rooms and repos reply checks compare by DID, ignoring a did:scid `src`. The picked-up sender is still returned as presented, as the live path returns it, so both route a message the same way. - A did:scid persona's listener speaks as its DID URL with `src` (`Config::presented_did`), so what it sends, and the `skid` the TDK derives from it, carry the source a first-contact peer needs. The listener id and the persona's secrets stay under the identity. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
…, trust-tasks 0.34 and did-git-sign 0.25 The published stack the did:scid personas need: - vta-sdk 0.73 (`vta_sdk::did_scid`, VTI #2257), with vta-service 0.65 and vti-vetting-pcs 0.6 in the dev graph - affinidi-tdk 0.32, affinidi-messaging-sdk 0.40 and affinidi-messaging-test-mediator 0.45 (TSP 1.0) - affinidi-did-resolver-cache-sdk 0.8.43 (native did:scid resolution) - didwebvh-rs 0.8.1 (the did:scid presentation of a did:webvh) - trust-tasks-rs / trust-tasks-capability-client 0.34.2 - did-git-sign / vgi-core 0.25 (VGI #168), on vta-sdk 0.73, so the graph keeps one vta-sdk; 0.24 hands 0.72's VtaClient across its API vta-sdk 0.73 resolves a VTA with OnUnresolved::Refuse, so an unresolvable did:web is no longer turned into a synthesized https://<domain> endpoint: TSP discovery reports Unavailable rather than NotAdvertised, and both keep trust tasks on DIDComm. The test pinning that outcome is updated. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
stormer78
force-pushed
the
feat/did-scid
branch
from
October 26, 2026 12:08
c9ff028 to
8688f7f
Compare
stormer78
marked this pull request as ready for review
October 26, 2026 12:08
On vta-sdk 0.73, affinidi-tdk 0.32 and trust-tasks 0.34, Benchmarks and Coverage outgrew the runner's memory: vta-sdk turns on every generated trust-tasks-rs spec, and the runner was shut down mid compile with exit code 143 and no compiler error. Every job that builds the workspace now gets a 16 GB swapfile (the test matrix on Linux only), as VGI's CI does. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
did:scid personas in OpenVTC (spec trustoverip/dtgwg-vti-spec#75).
preferred_did_method/scid_also_known_as(optional, unset = unchanged behaviour); per-persona choice in create-persona and join; mint viacreate_did_webvh_presented, key ids match the native document;PersonaRecord.did_locatorseeds the resolver's did:scid sources at load.src; did:scid ≠ its did:webvh.Dependencies (all published on crates.io; no
[patch]):vta-sdk0.73 (vta_sdk::did_scid, feat(vta)!: did:scid:vh:1 identities, create/1.2, and VTA/VTC presentation config verifiable-trust-infrastructure#2257); dev:vta-service0.65,vti-vetting-pcs0.6affinidi-tdk0.32,affinidi-messaging-sdk0.40, devaffinidi-messaging-test-mediator0.45 (TSP 1.0)affinidi-did-resolver-cache-sdk0.8.43 (native did:scid, feat(identity, messaging)!: native did:scid:vh:1 — resolution, source memory, and DIDComm as itself affinidi/affinidi-tdk-rs#965)didwebvh-rs0.8.1 (feat: did:scid:vh:1 conversions; dependency refresh for security advisories (v0.8.1) decentralized-identity/didwebvh-rs#56)trust-tasks-rs/trust-tasks-capability-client0.34.2 (feat(vta/webvh/dids/create): 1.2 chooses the did:scid identity and the alsoKnownAs alias trustoverip/dtgwg-trust-tasks-tf#862, #863)did-git-sign/vgi-core0.25 (feat: did:scid signers, VTCs and bridge identities verifiable-git-infrastructure#168, v0.25.0), on vta-sdk 0.73, so the graph keeps one vta-sdk / TDK / trust-tasks (cargo tree -dis clean for the stack)Behaviour change from vta-sdk 0.73: an unresolvable
did:webVTA is refused rather than synthesized intohttps://<domain>, so TSP discovery reportsUnavailableinstead ofNotAdvertised(both stay on DIDComm). The test that pinned the old outcome is nowan_unresolvable_did_web_is_unavailable.Tests:
cargo fmt --check; clippy-D warnings(all features, default,dev-overrides);cargo testall features (2148 passed, 0 failed),--no-default-features,dev-overrides,--ignored;cargo doc. All pass locally.Deferred: rebuild-from-VTA brings a did:scid persona back as did:webvh (VTA list/get gap); peers'
srcnot persisted.