[leifj]

Preparation only. Nothing is deployed and the pinned gdc verifier image is unchanged. gdc's verifier (local-1792456320, vc 6c3ac47) predates SUNET/vc#832 and ignores the new keys (non-strict unmarshal). Enabling nym_auth verification needs vc's next integration build (verifier steps 1-3b + docs) built with the zknative tag, then dockerfiles/verifier-nymauth.Dockerfile over it, then a pin bump in a follow-up commit; the coordination session says when.

What this adds

• environments/gdc.yaml values.verifier.extraConfig: verifier.nym_auth (enable, verifier_id, one allowlist entry known-offender-matching-ssc) and preferred_vp_formats.circuit_zk (the existing dc+sd-jwt entry stays).
• dockerfiles/verifier-nymauth.Dockerfile: bakes the DECOMPRESSED circuit artifact (1,062,842 bytes) into the verifier image at /etc/vc/circuits/nym_auth-ssc.bin, checking size and SHA-256 at build time. It cannot be a Fly file secret (base64 of it exceeds the ~1 MiB machine config body) and it is not in the vc repo. Build input fixtures/nym-auth-circuits/nym_auth-ssc.bin is gitignored; the source is our circuits archive (longfellow/mdoc/circuits.zst, compressed sha256 6c4b96ed431ee547a3a2e5b62621943a9a0a44646267653bf2db0fcc269b5c3b, no repository yet).
• vc_render.integral_nym_auth_numbers: Helm renders artifact_bytes 1062842 as 1.062842e+06, which PyYAML dumped as 1062842.0, and vc's allowlist field is an integer. Found by reading the rendered file, not by the parity check.
• tests/test_nymauth_verifier_render.py (8 tests), the parity entry for verifier.nym_auth, README paragraph.

Values, and where each came from

value	source
hash/sig circuit ids, block_enc_*, artifact_bytes, artifact_sha256	zk-cred-longfellow src/nymauth/profile.rs; I decompressed the archive myself: 1,062,842 bytes, sha256 92dd42fdf99673249eec33c7d07850bd9da66fbdab01ef26391e04c8341c1b7f, and params.tsv lists the same ids/blocks
NOT the digest in vc's docs/CONFIGURATION.md	that example is a placeholder with 52 zeros in the middle (first 8 and last 4 hex are real, so a head/tail check passes it); a test rejects any run of zeros
verifier_id = sirosid-gdc-vc-verifier.fly.dev	the bare host of the verifier's public_url (client_id is x509_san_dns:<that host>). Changing it changes every pseudonym this verifier reports
trust.pdp_url	already set by the chart to the PDP BASE url (http://sirosid-gdc-pdp.internal:8080; the client appends /evaluation)

PDP check (2026-10-20, replayed against the live gdc PDP, nothing deployed)

Request as vc builds it (pkg/trust GetEffectiveAction + buildX5CRequest): subject {key, <issuer URL from the leaf URI SAN>}, resource {x5c, same id, key = [leaf, chain] base64 DER}, action mdoc-issuer (role credential-issuer + a non-mDL docType). Result: decision true from the mDOC IACA registry for the gdc issuer's chain; a self-signed chain with the same SAN: decision false for mdoc-issuer and for credential-issuer. So a holder cannot pick its own issuer key against gdc's PDP.

Local verification (2026-10-20, vc df033238 v5 + this overlay, rendered gdc config, nothing deployed)

• Starts: nym_auth verification enabled, Trust evaluator initialized (authzen, pdp_url = the PDP base URL).
• Refuses to start without trust.pdp_url, with an empty allowlist, with a x509_san_dns:-prefixed verifier_id, with a same-size wrong artifact (digest named) and a wrong-size artifact.
• Found and fixed here: the first overlay image panicked with open /etc/vc/circuits/nym_auth-ssc.bin: permission denied because COPY --chmod=0444 also gave the new directories 0444; the Dockerfile now stages the directories at 0755 and the file at 0444.
• vc's native tests pass inside the same builder (tampered proof, other verifier's pseudonym, widened age window, other time, tampered circuit / wrong block parameters). NOT tested: a real wallet presentation (the verification-time T is not yet agreed between wallet and verifier, so a real presentation is expected to fail with an opaque proof failure, not a config problem) and a non-allowlisted circuit_id in a live HTTP response.
• With the unmodified gdc certificate the verifier logs WARN: certificate does not cover PublicURL host ... wallets will reject every request object; it disappears with the certificate re-issued by create-pki: add the verifier's dNSName to the signing cert (same key and root) #80 .

Open items for review

• The gdc verifier signing cert has no dNSName sirosid-gdc-vc-verifier.fly.dev; fixed separately, opt-in for gdc, in create-pki: add the verifier's dNSName to the signing cert (same key and root) #80 . Both PRs edit the verifier: block of environments/gdc.yaml, so the second to merge needs a small rebase.
• The plain credential-issuer action is a looser fingerprint whitelist (pid-issuers), not what the verifier exercises; no gdc policy was added for it.

Tests

Full suite: only test_chat.OpenRouterTests (4 errors, LlmError not defined) fails, in code this PR does not touch. New tests proven non-vacuous: a prefixed verifier_id and the placeholder digest each fail them; reverting the integer normalisation fails the number test. make vc-config-parity clean.

DEPLOYED on gdc (2026-10-21), from branch deploy/gdc-nymauth-verifier (head 5c98f40, contains this PR and #80, NEITHER merged)

• vc-verifier registry.fly.io/sirosid-gdc-vc-verifier:local-1792542047 (digest sha256:d79a3b058d0340cf6012a362b670cd8f4fd3d1baad28004b5830058a6147c6c2) = vc integration/gdc-nymauth-v5 @ 253a17e92af49255b9c2597d092a71950abff14e with the ZK libs v0.1.2 / v0.0.7 by full SHA, zknative, + the artifact overlay. The earlier 094549cc build cannot answer a zkp_req request (it never wrote meta.source_format) and was not deployed; the intermediate ae33687f build ran on gdc 2026-10-20.
• Config here is the v0.4 shape: zkp_req (system_id_values / proof_system_values), verifier_id = x509_san_dns:sirosid-gdc-vc-verifier.fly.dev, presets nym_auth_pseudonym and nym_auth_pseudonym_age (age window 1980-01-01..2000-12-31, which alice-001 satisfies).
• Live: startup clean; /ui/metadata publishes both presets with meta {doctype_value, source_format: mso_mdoc}; a POST /ui/interaction request object carries client_id x509_san_dns:sirosid-gdc-vc-verifier.fly.dev, response_mode direct_post.jwt, an ES256 oauth-authz-req+jwt whose x5c leaf has the dNSName sirosid-gdc-vc-verifier.fly.dev; the dcql credential is format zkp_req with _req; the issuer /.well-known is still advertisement-only.
• Re-pin to a released vc verifier image when SUNET/vc releases the verifier stack. A real wallet presentation is expected to need the engine PRs (go-wallet-backend 469/471, 163) and the agreed verification time.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Shared gdc settings enable verification in Compose without supplying the required circuit artifact.

1 open issue

• Compose verifier lacks nym_auth artifact mount · New

What changed in this PR

Prepares gdc for nym_auth verification without deploying or changing its pinned verifier image.

Changes:

• Adds verifier settings and a checked circuit-artifact image overlay.
• Normalizes numeric allowlist fields after Helm rendering.
• Adds rendering tests, parity expectations, and documentation.

File	Description
tests/​test_nymauth_verifier_render.py	Tests verifier settings and artifact metadata.
sirosid_core/​vc_render.py	Normalizes integral allowlist numbers.
README.md	Documents verification prerequisites.
fixtures/​vc-config-golden/​accepted-diffs.yaml	Records the expected configuration addition.
environments/​gdc.yaml	Adds nym_auth settings and format advertisement.
dockerfiles/​verifier-nymauth.Dockerfile	Packages and validates the circuit artifact.
.gitignore	Excludes the local artifact binary.

_{Review effort: Balanced}

[leifj]

Contained in and superseded by #81 (the branch gdc runs, with the pin provenance). Review and merge that one and close this, or merge this first and I rebase it.