Repository navigation
gdc and nymauth: no offer twins; vc images from c8c5b1ea (SUNET/vc#840) as the standing pin - #87
Merged
Merged
Conversation
…(per environment) and datastore-offer follows the rendered config SUNET/vc#840. issuer.allowPreauthOffer (default off; on for gdc) renders allow_preauth_offer on every login-gated datastore scope. scripts/datastore.py mints against the base scope when the rendered config flags it, else the <type>_offer twin; a named twin is never rewritten. The twins stay; step B removes them after an offer for the base scope has been redeemed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…Offer drops the <type>_offer twins vc_render.drop_offer_twins removes the preauth credential types and their bootstrapping documents from the base values for such an environment (gdc), so the issuer, the datastore scopes and the verifier carry one entry per type. Other environments keep their twins. DO NOT DEPLOY before an offer minted for the base scope has been redeemed (step A): offers that name a configuration id the issuer no longer publishes are unredeemable. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…at/no-twins-with-840
… as the standing pin Lands twins steps A and B (the stranded #83/#84) and pins vc images built from a SHA that contains #840 until it is merged to vc main: tests/test_pins_carry_840.py, a PIN PROVENANCE block naming #840 and the SHA, nymauth.yaml sets issuer.allowPreauthOffer like gdc. Offers now name the base scope (make datastore-offer SCOPE=nym_auth DOCUMENT_ID=document_id_nym_auth_alice-001). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
leifj
added a commit
that referenced
this pull request
Oct 21, 2026
docs: no datastore-sync step in environments with #840 (follow-up to #87)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Not deployed yet. Decision (user, 2026-10-22): remove the offer twins and pin vc builds that include SUNET/vc#840 as standard practice until it is merged to vc main.
Why this is one PR
Steps A and B of the twins plan (#83 and #84) were merged into their stacked branches AFTER #81 had merged, so neither reached
main. This PR lands both (branchfeat/remove-offer-twinsmerged cleanly) together with the pins that make them work.What
issuer.allowPreauthOffer: truerendersallow_preauth_offeron the 12 login-gated datastore scopes andvc_render.drop_offer_twinsdrops the<type>_offertypes and their documents for such an environment (issuer metadata 26 -> 14, datastore scopes 24 -> 12). Environments without the flag (compose, other Fly environments with released vc images) keep their twins.make datastore-offer SCOPE=nym_auth DOCUMENT_ID=document_id_nym_auth_alice-001mints against the base scope.c8c5b1eafd0ff08c14ca3cf8ebaceaa4473533f0(integration/gdc-nymauth-v5; includes feat(apigw): offer a login-gated credential without a twin scope SUNET/vc#840 @ 952426dc5, feat(verifier): the nym_auth circuit allowlist, and what may be loaded SUNET/vc#827 @ 80d6ee9ef, feat(openid4vp): validate a zkp_req response against the request SUNET/vc#829 @ 19efd24c7, feat(verifier): dispatch a zkp_req presentation to the nym_auth verifier SUNET/vc#830 @ 90f227fcd (classified zkp_req refusals), feat(nymauth): bind a redirect-delivered zkp_req presentation to its own handover SUNET/vc#831 @ 0364b170b, docs(verifier): how to run a nym_auth verifier, and what each refusal means SUNET/vc#832 @ 3f8efba54, fix(nymauth)!: convert main to rulebook v0.4 SUNET/vc#839 @ 94a6e6732, upstream main 6130eed28): all four pinned aslocal-1792609658in bothenvironments/gdc.yamlandenvironments/nymauth.yaml(digests in the PIN PROVENANCE block: verifiersha256:9385f5bf..., apigwsha256:bb1a46f3..., issuersha256:9064f735..., registrysha256:afa31586...).tests/test_pins_carry_840.py- the provenance block must name #840 and the SHA, every environment that sets the flag must pin gdc's vc images, and the four share one epoch tag. nymauth.yaml now setsallowPreauthOfferlike gdc (it was created before the flag existed).docs/NYMAUTH-TESTING.md(offer command, no datastore-sync step, #840 gotcha, pins), README note.Verified locally with the new images (not live)
The new apigw starts with gdc's rendered config and the flag on all 12 base scopes (gdc:
api_auth.jwks.enabletrue,admin_ui_enablefalse). Withadmin_ui_enable: trueit refuses to start with #840's guard message naming the scopes. A pre-authorized offer minted fornym_auth(alice-001) returns 200 withcredential_configuration_ids: ["nym_auth"];nym_auth_offeris gone (400 invalid_scope). The new verifier starts with the gdc config (earlier checks: refusals, presets). Not yet tested: redeeming a base-scope offer in a wallet. The current Pixel APK cannot be used for that once the client-side-encryption engine is deployed (known, accepted); the verification here is mint-level only.Tests
New
test_pins_carry_840(4);test_nymauth_environmentupdated (no twins, flag set);test_offer_without_twins/test_verifier_credential_metadatafrom the merged branches; golden refreshed;make vc-config-parityclean. Full suite: only the 4 unrelatedtest_chaterrors (missing optional dependency).Deploy
Together with the pending engine redeploy (one
make fly-up ENV=gdc): vc images and twin removal first drop the verifier's and issuer's sessions once. The engine pin (and its provenance) follows in its own commit when the build is handed over.🤖 Generated with Claude Code