chore(core): take adminScope from the registry binding, not a local copy - #189
Merged
Conversation
`@openvtc/trust-tasks` 0.17.4 is the first release whose generated `provision/integration/0.3` binding declares `adminScope` and the `context` / `adminScope` summary members. This package shipped ahead of it, so it declared all three by hand with a comment promising they would go the moment the binding caught up. It has, so they go. `AdminScope` stays as an exported name — a dozen wallet surfaces name the concept without ever touching the payload type — but it is now derived (`NonNullable<ProvisionIntegrationPayload["adminScope"]>`) rather than written out. A hand-kept union is a second declaration of a registry-owned vocabulary and is free to drift from it silently; a derived one cannot. `ProvisionIntegrationResponseBody` collapses back to the generated response type for the same reason. The two version floors are named in CLAUDE.md now that they are concrete, with the part that is easy to get wrong: `trust-tasks-rs` 0.18.3 is a correctness constraint on the VTA because its dispatch spine validates **outgoing** responses against the embedded schema, not just inbound payloads. Against 0.18.2 the new summary members are emitted and then refused by the agent's own guard, so a provisioning that fully succeeded returns `500 responseSchemaViolation`. That is what the VTA-side PR's `delegated_consent_e2e` failure was, and it is worth recording as something other than a dormant feature. No behaviour change: same wire members, same spellings, one source for them. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
6 tasks
stormer78
added a commit
to OpenVTC/verifiable-trust-infrastructure
that referenced
this pull request
Sep 8, 2026
…can render (#1306) `initiate_disclosure_step_up` emitted a flat bag of members with no `type`. `vta-mobile-core` passes the authorization context to the native layer to "decode and render as the approval card", and that card discriminates on a `type` URI — so the context that exists to show the approver what would leave was one no card could be chosen for. Now the shape every authorization context uses: `{type, summary, risk, action}`, with the specifics under `action` keyed by `kind`. `summary` is the same string as `reason` on purpose — `reason_and_context` reads `summary` back out as the reason, so two sentences would put two accounts of one act in a single signed document. `risk: "high"` restates the claim-type registry's judgement rather than making a fresh one: everything reaching this gate is a type the registry marked `release: stepUp`. Cuts over with OpenVTC/vta-browser-plugin#189, which reads the new shape and refuses a context whose `type` is not this one — a share ask travels under the same `ext` key and must never be shown in a disclosure's words. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the loose end #187 left behind.
@openvtc/trust-tasks0.17.4 is the first release whose generatedprovision/integration/0.3binding declaresadminScopeand thecontext/adminScopesummary members. #187 shipped ahead of it, socore/src/provision/send.tsdeclared all three by hand, with a comment promising they would go the moment the binding caught up. It has (trustoverip/dtgwg-trust-tasks-tf#385, released in #383), so they go.What changes
adminScopeon the request body — deleted;ProvisionIntegrationPayloadcarries it.ProvisionIntegrationResponseBody— collapses from anOmit<…> & { summary: … & {…} }back to the generated response type.AdminScope— kept as an exported name, because a dozen wallet surfaces (store.ts,grant-command.ts,bridge-protocol.ts,onboard-view.tsx) name the concept without ever touching the payload type. But it is now derived:A hand-kept union is a second declaration of a registry-owned vocabulary and is free to drift from it silently. A derived one cannot — which is what CLAUDE.md's "match the spelling the registry declares today" is actually asking for.
And the floors, now that they are concrete
CLAUDE.md said "the registry release carrying
adminScope". It can name versions now, and it records the part that is easy to get wrong:trust-tasks-rs0.18.3 is a correctness constraint on the VTA, not a preference, because its dispatch spine validates outgoing responses against the embedded schema — not just inbound payloads, which is all I had accounted for. Against 0.18.2 the new summary members are emitted and then refused by the agent's own guard, so a provisioning that fully succeeded returns500 responseSchemaViolation. That is what OpenVTC/verifiable-trust-infrastructure#1303'sdelegated_consent_e2efailure was. Worth recording as something other than "a dormant feature until the bump", which is how I first described it.Verification
No behaviour change — same wire members, same spellings, one source for them.
npm run lint,npm test(914 pass) andnpm run buildclean.The caret resolves to 0.17.5, which is current.