[leifj]

DRAFT, nothing deployed, no Fly app created. Stacked on #81 (base = its branch deploy/gdc-nymauth-verifier; open). Independent of the twins drafts #83 and #84.

What

1. environments/gdc.yaml: the pin-provenance block now records the known-good set that produced the proven nym_auth flow (engine local-1792564143 = go-wallet-backend 9cb6e57 with engine: OID4VCI credential request encryption (JWE, application/jwt) go-wallet-backend#469, feat(engine): relay verifier client_metadata; fail direct_post.jwt without verifier key thumbprint go-wallet-backend#471 (with the #473 fix), feat: WMP (Wallet Messaging Protocol) integration go-wallet-backend#163, feat(engine): sign-stage refusal ends RequestSign and answers verifier access_denied go-wallet-backend#472; verifier local-1792603698 = vc a56c4be9e; PDP go-trust 0.26.0 with the verifier_ids policies; issuer images local-1792473614; ZK libs v0.1.2 / v0.0.7; matcher 0.11.0; catalog go-zk-circuits release v0.1.0-release.16) and a short list of the nymauth-critical settings. The vc build with classified refusals + feat(apigw): offer a login-gated credential without a twin scope SUNET/vc#840 is named as the next, not-yet-proven set. gdc itself is unchanged (comments only).
2. environments/nymauth.yaml (new): the same stack on its own hostnames, so the team has a known starting point. values: is gdc's with only the verifier host changed (verifier_id = x509_san_dns:sirosid-nymauth-vc-verifier.fly.dev, the prefixed client_id of ITS OWN verifier); images are the same proven pins (from gdc's registry namespace). Dropped as not needed: the Geneva/yitbarek/multipaz/Accredify interop trust and the Geneva RICAL. Kept identical to gdc: the Vega presets and zk_circuits_sources (the pinned verifier was proven with them), wallet attestation, the sample app's signing keys. diff environments/gdc.yaml environments/nymauth.yaml is the nymauth-specific part.
3. docs/NYMAUTH-TESTING.md (linked from the README): a tester walkthrough in terms of what the wallet and the verifier page show (sign in; Settings > Request policy > "zkp_req requests" ON; get the credential; pick a preset on the verifier page, scan; consent screens; the "Verification succeeded" / "Credential claims" result; what failure looks like), a gotchas table (symptom / cause / fix), operator steps clearly separated, and a "For developers" appendix (curl for /ui/interaction, adb, the result API, log capture, PDP replay, pins). Wording is taken from the sample app's strings and the verifier page's HTML.
4. tests/test_nymauth_environment.py (8): nymauth's values equal gdc's with only the verifier host swapped, the same image pins, the dropped keys, verifier_id equals the prefixed client_id of its own host, the zkp_req formats / presets / PDP policies / seed delivery are set, and no gdc hostname leaks into the rendered configs. Proven non-vacuous (changing verifier_id fails three). test_create_pki_verifier_san now allows signingCertDnsSan for gdc and nymauth only. Full suite: only the unrelated 4 test_chat errors.

What make fly-up ENV=nymauth would create (do not run it unless you mean to)

11 apps in arn: sirosid-nymauth- + mongodb, mini-oidc, pdp, vc-registry, vc-issuer, vc-apigw, vc-verifier, wallet-backend, wallet-proxy, wallet-frontend, env-admin; a Mongo volume; secrets (signing key, JWT/admin secrets, the permanent seed secret, the credential-encryption key); per-app deploy tokens for env-admin; public *.fly.dev hostnames; and a generated PKI under fixtures/rendered/fly-nymauth/ (gitignored; keep it). make fly-down ENV=nymauth removes it.

Checked locally, not live

The rendered configs start: the pinned verifier image starts with nymauth's rendered config (nym_auth enabled, trust evaluator on http://sirosid-nymauth-pdp.internal:8080), and go-trust 0.26.0 loads its PDP config (policies for the two verifier actions, whitelist of its own hosts). Not exercised: the deploy itself, and pulling gdc's images into the new apps (the pins point at registry.fly.io/sirosid-gdc-*; if the account cannot pull them, push the same images to the new apps' registries and repin).

Not changed

Nothing live. The twins stay (the pinned apigw lacks #840), so the offer command for nymauth is make datastore-offer SCOPE=nym_auth DOCUMENT_ID=document_id_nym_auth_offer_alice-001 ENV=nymauth.

🤖 Generated with Claude Code