Skip to content

chore(core): take adminScope from the registry binding, not a local copy - #189

Merged
stormer78 merged 1 commit into
mainfrom
chore/adopt-trust-tasks-0.17.4
Sep 7, 2026
Merged

chore(core): take adminScope from the registry binding, not a local copy#189
stormer78 merged 1 commit into
mainfrom
chore/adopt-trust-tasks-0.17.4

Conversation

@stormer78

Copy link
Copy Markdown
Contributor

Closes the loose end #187 left behind.

@openvtc/trust-tasks 0.17.4 is the first release whose generated provision/integration/0.3 binding declares adminScope and the context / adminScope summary members. #187 shipped ahead of it, so core/src/provision/send.ts declared all three by hand, with a comment promising they would go the moment the binding caught up. It has (trustoverip/dtgwg-trust-tasks-tf#385, released in #383), so they go.

What changes

  • adminScope on the request body — deleted; ProvisionIntegrationPayload carries it.

  • ProvisionIntegrationResponseBody — collapses from an Omit<…> & { summary: … & {…} } back to the generated response type.

  • AdminScope — kept as an exported name, because a dozen wallet surfaces (store.ts, grant-command.ts, bridge-protocol.ts, onboard-view.tsx) name the concept without ever touching the payload type. But it is now derived:

    export type AdminScope = NonNullable<ProvisionIntegrationPayload["adminScope"]>;

    A hand-kept union is a second declaration of a registry-owned vocabulary and is free to drift from it silently. A derived one cannot — which is what CLAUDE.md's "match the spelling the registry declares today" is actually asking for.

And the floors, now that they are concrete

CLAUDE.md said "the registry release carrying adminScope". It can name versions now, and it records the part that is easy to get wrong:

trust-tasks-rs 0.18.3 is a correctness constraint on the VTA, not a preference, because its dispatch spine validates outgoing responses against the embedded schema — not just inbound payloads, which is all I had accounted for. Against 0.18.2 the new summary members are emitted and then refused by the agent's own guard, so a provisioning that fully succeeded returns 500 responseSchemaViolation. That is what OpenVTC/verifiable-trust-infrastructure#1303's delegated_consent_e2e failure was. Worth recording as something other than "a dormant feature until the bump", which is how I first described it.

Verification

No behaviour change — same wire members, same spellings, one source for them. npm run lint, npm test (914 pass) and npm run build clean.

The caret resolves to 0.17.5, which is current.

`@openvtc/trust-tasks` 0.17.4 is the first release whose generated
`provision/integration/0.3` binding declares `adminScope` and the
`context` / `adminScope` summary members. This package shipped ahead of
it, so it declared all three by hand with a comment promising they would
go the moment the binding caught up. It has, so they go.

`AdminScope` stays as an exported name — a dozen wallet surfaces name the
concept without ever touching the payload type — but it is now derived
(`NonNullable<ProvisionIntegrationPayload["adminScope"]>`) rather than
written out. A hand-kept union is a second declaration of a
registry-owned vocabulary and is free to drift from it silently; a
derived one cannot. `ProvisionIntegrationResponseBody` collapses back to
the generated response type for the same reason.

The two version floors are named in CLAUDE.md now that they are concrete,
with the part that is easy to get wrong: `trust-tasks-rs` 0.18.3 is a
correctness constraint on the VTA because its dispatch spine validates
**outgoing** responses against the embedded schema, not just inbound
payloads. Against 0.18.2 the new summary members are emitted and then
refused by the agent's own guard, so a provisioning that fully succeeded
returns `500 responseSchemaViolation`. That is what the VTA-side PR's
`delegated_consent_e2e` failure was, and it is worth recording as
something other than a dormant feature.

No behaviour change: same wire members, same spellings, one source for
them.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
@stormer78
stormer78 merged commit 7e1b382 into main Sep 7, 2026
3 checks passed
@stormer78
stormer78 deleted the chore/adopt-trust-tasks-0.17.4 branch September 7, 2026 20:47
stormer78 added a commit to OpenVTC/verifiable-trust-infrastructure that referenced this pull request Sep 8, 2026
…can render (#1306)

`initiate_disclosure_step_up` emitted a flat bag of members with no `type`.
`vta-mobile-core` passes the authorization context to the native layer to
"decode and render as the approval card", and that card discriminates on a
`type` URI — so the context that exists to show the approver what would leave
was one no card could be chosen for.

Now the shape every authorization context uses: `{type, summary, risk,
action}`, with the specifics under `action` keyed by `kind`.

`summary` is the same string as `reason` on purpose — `reason_and_context`
reads `summary` back out as the reason, so two sentences would put two accounts
of one act in a single signed document. `risk: "high"` restates the claim-type
registry's judgement rather than making a fresh one: everything reaching this
gate is a type the registry marked `release: stepUp`.

Cuts over with OpenVTC/vta-browser-plugin#189, which reads the new shape and
refuses a context whose `type` is not this one — a share ask travels under the
same `ext` key and must never be shown in a disclosure's words.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant