Repository navigation
No status behind a seal that didn't hold - #33
Merged
Merged
Conversation
Contributor
|
Try it: https://digitalcredentials.github.io/verifier-plugin/pr-33/ Updates on every push to this PR, and goes away when it closes. The browser tests run against this copy too. |
Collaborator
Author
|
threeqube
force-pushed
the
status-row-behind-unheld-seal
branch
from
October 22, 2026 18:56
2277015 to
e30f2d3
Compare
threeqube
added a commit
that referenced
this pull request
Oct 23, 2026
Vitest fails any test file that runs longer than 60 seconds, whatever its
results ("Timeout calling onTaskUpdate"). The consistency suite grew to
105,499 tests in one file, and CI machines vary about threefold in speed:
it passed in 34 s on #31 and failed twice at 70 s on #33, every test
passing. Reproduced locally by slowing it past 60 s; two 40 s files run
back to back on one worker pass, so the limit is per file.
The combinations, their builders and the agreement rules move unchanged
to consistency-combinations.ts. consistency-1 to -4 each run every fourth
combination (26,358 each, 105,432 in all). consistency.test.ts keeps the
claim patterns, the nameless-issuer check (whole, about 10 s) and the
stopped-early cases, and gains one test that every part has its file, so
a lost file can't drop a quarter of the combinations unnoticed.
Checked: 105,698 tests (105,697 plus that one); four deliberate breaks
fail exactly as many tests as on the single file (29,147, 14,571, 1,010,
14,573); the guard fails with a part missing or one extra; the slowdown
that failed the single file at 73 s passes split, files run one at a
time (each at most 17 s). The whole run takes about 10 s, not 25.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
threeqube
force-pushed
the
status-row-behind-unheld-seal
branch
from
October 24, 2026 14:49
e30f2d3 to
0439434
Compare
Whether a credential has a status list, and which entry of it is its own, are the credential's claims. Behind a seal that didn't hold they vouch for nothing, yet the Status row said "the issuer set up no way to deactivate this" for a tampered credential with no status entry, which removing that entry would buy. It now reads "not checked", as the Dates row does since #31. The same holds for the headline: "deactivated" and "on hold" are believed only behind a held seal. The library halts after a failed seal, so it can't produce either today, but the rule must not depend on that. notWithdrawn needs no guard: everything that reads it already stands behind a held seal. A test that pinned "withdrawn" behind a missing seal, to check the action named nobody, now pins signature_unchecked and still checks that. The consistency suite gains the rule that the Status row reads "not checked" behind an unheld seal. Mutation: dropping the row guard fails 20782 tests, the withdrawn guard 1853, the on-hold guard 1852. Closes #32 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The "names nobody" test pinned signature_unchecked, whose words never carry a name, so it could no longer fail. It now pins "built wrong" behind a missing seal, the verdict whose action would name the issuer; ungating `named` fails it. The withdrawal half is its own test. - notWithdrawn is guarded like its siblings. No test can catch it today, since every reader stands behind a held seal; it guards the one claim that must never leak past a broken seal. - The consistency rule checks the Status row's severity as well as its value (40860 failures when it reads success). - Row-level tests for a tampered seal over a list that came back clear, says deactivated, or says on hold. A duplicate of an existing test goes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reason notWithdrawn keeps a guard no test can catch moves to its own docblock, so it doesn't look removable. The tampered-seal row tests say they pin the row's guard, and name where the predicate guards are pinned; their headline assertion, which couldn't fail, goes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From the final review (24 October 2026): - isSuspended's seal guard had no unit test; only the consistency suite caught its removal. "Believes no hold when the seal never reported" mirrors the withdrawal test. Mutation: the guard removed fails it (it failed no unit test before). - The three tampered-list Status row tests said they pinned the row's own guard. They pass if either the row's guard or the matching predicate's is there (notWithdrawn's for a clear list); the comment now says so, and names what pins each alone. Checked: the row guard removed fails only the two "no list" cases; the withdrawal guard, "believes no withdrawal"; the hold guard, the new test; the row and notWithdrawn guards together, the clear-list case. - The consistency comment on the Status row behind a broken seal is in the present tense again: this PR is the verifier-plugin#32 fix. Checked: lint, typecheck, 105,720 tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
threeqube
force-pushed
the
status-row-behind-unheld-seal
branch
from
October 24, 2026 22:17
0439434 to
c3cb349
Compare
Collaborator
Author
|
Collaborator
Author
Post-merge check (29 October 2026)Checked on the live demo and the
The wallet still pins an earlier build (a4ca3e6), so none of this reaches it until that pin is bumped. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #31 — review and merge that first.
Closes #32.
What and why
Whether a credential has a status list, and which entry of it is its own, are the credential's own claims. Behind a seal that didn't hold they vouch for nothing. Yet the Status row read "the issuer set up no way to deactivate this" for a tampered credential with no status entry, and stripping that entry would buy exactly that.
notWithdrawnkeeps the same guard even though no test can catch it today: everything that reads it already stands behind a held seal. The code comment explains why it stays.What the earner sees differently: on the demo, Changed (tampered) and the website-down
?vc=link (badDidWeb.json) now show Status "not checked" instead of "the issuer set up no way to deactivate this". Nothing changes when the seal held.Validation
test/consistency-combinations.ts, since Move to verifier-core 2.0.0-beta.1 #31 split it) gains a rule: behind an unheld seal, the Status row reads "not checked", with severity unchecked.notWithdrawn's guard fails no test on its own, as its comment explains; with the Status row's guard also removed, the clear-list test fails.?vc=linkslegacy-noStatus-noExpiry-tamperedandbadDidWeb— each only in the Status row, "the issuer set up no way to deactivate this" → "not checked".Reviews
Rebased twice onto #31 as it grew; the content of the first three commits is unchanged (checked line by line). Their IDs on this branch:
The final review ran 164,232 inputs through the code against #31's: behind an unheld seal, no headline, detail, action or row says anything about status; where the seal held, nothing differs. c3cb349 adds a unit test for the "on hold" guard (it had none) and corrects two comments about what the tests pin.
The 41948db review found that the rewritten "names nobody" test could no longer fail. It now pins "built wrong" behind a missing seal, the verdict whose action would otherwise name the issuer.
Deferred
The seal guard is applied check by check (dates, status, the action's name). A single "trusted checks" view, which drops seal-dependent results when the seal didn't hold, would cover future readers in one place. That's a larger restructure than this PR should carry.
🤖 Generated with Claude Code