[leifj]

Step 1 of the offer-twins plan (chart only; no vc change; nothing minted differently). Stacked on #81 (base = its branch deploy/gdc-nymauth-verifier); retarget to main once that merges.

What

The verifier's common.credential_metadata no longer lists the pre-authorized offer twins (<type>_offer, authProvider: preauth). New helper siros-id.vc.credentialMetadataVerifier in chart/templates/_helpers.tpl (the shared renderer gets a skipPreauth flag), used by chart/templates/04-verifier.yaml.

Why

The twins from #76 exist because vc's POST /api/v1/datastore/preauth_offer accepts only a scope whose datastore auth_provider is preauth, so each login-gated type needs a second scope. They are issuance-only, yet they were also written into the verifier's credential metadata, so the verifier's /ui/metadata and picker listed every type twice (26 entries on gdc, 12 of them twins).

Effect

Verifier picker / /ui/metadata on gdc: 26 -> 14 entries (after the next verifier deploy; the live verifier still lists 26 today). Nothing verifier-side resolves a scope by its _offer name; the nym_auth zkp_req presets use scope nym_auth, whose source_format and doctype_value come from credential_metadata[nym_auth], which stays.

Not changed

The issuer's credential_configurations_supported still lists the twins (an offer's credential_configuration_id resolves against it; OpenID4VCI has no hidden configuration), as does issuer-core's block. Minting is unchanged: make datastore-offer and the Pixel nym_auth rounds keep scope nym_auth_offer. Step 2 (vc allow_preauth_offer flag with a startup guard; then delete the _offer scopes and move the offer command to the base scope) waits for a reviewed vc image.

Tests

tests/test_verifier_credential_metadata.py (4): no _offer key reaches the verifier; every base scope stays and nym_auth resolves (mso_mdoc, /vctms/nym_auth.mdoc.json); the issuer keeps all its twins; the verifier has 14 entries on gdc. Proven non-vacuous: with the template change reverted the first, second, third and fourth tests fail. make vc-config-parity clean. tests/golden/fly_up.json refreshed: only the verifier config and the inlined values hash change (the latter also carries signingCertDnsSan from #80, whose golden had not been refreshed). Full suite: only the 4 test_chat.OpenRouterTests errors (LlmError undefined, unrelated) fail.

Deploy: folded into the next verifier deploy, or on its own if asked; it drops the verifier's sessions once.

🤖 Generated with Claude Code