@openvtc/trust-tasks 0.12.8 → 0.12.10

package/src/vtc/config/import/0.1/payload.ts

@@ -56,6 +56,7 @@ export interface CommunityProfileSnapshot {
    * The community's declared relationship-identifier default, as defined on `CommunityProfile` in the `vtc/_shared/0.1/community` schema. Carried in a config export so a restore reproduces the declaration rather than silently reverting it to the implementation default.
    */
   relationshipIdentifierDefault?: "attributed" | "pairwise";
+  personhood?: PersonhoodGovernance;
   /**
    * Opaque community-defined extension bag.
    */
@@ -65,6 +66,27 @@ export interface CommunityProfileSnapshot {
    */
   createdAt?: string;
 }
+/**
+ * The community's published personhood position, carried so an export restores it. Governance state, not runtime state — unlike `registryStatus`, which is deliberately absent here because reachability belongs to a running maintainer rather than to exported state.
+ */
+export interface PersonhoodGovernance {
+  /**
+   * Governance requires that members are real humans. Defaults to `false` when absent: a community that has not considered the question asserts nothing, which is the only safe default for a claim a verifier may rely on.
+   */
+  realHuman?: boolean;
+  /**
+   * Governance requires that each person holds at most one membership in **this** community. Per-community by definition — the glossary says "exactly one membership in that VTC" — so a single community can satisfy it without any network above it.
+   */
+  singleMembership?: boolean;
+  /**
+   * DIDs of the identity-verification providers whose credentials this community accepts as personhood evidence. A community that vets its own members in person lists its own community DID here — it is acting as its own IDVP, which §IDVC permits. An empty list means no list has been published, not that everything is accepted.
+   */
+  acceptedIdvps?: string[];
+  /**
+   * Where the governance framework these assertions refer to can be read.
+   */
+  governanceFrameworkUrl?: string | null;
+}
 /**
  * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
  */
@@ -375,6 +397,10 @@ export const PAYLOAD_SCHEMA = {
           ],
           "description": "The community's declared relationship-identifier default, as defined on `CommunityProfile` in the `vtc/_shared/0.1/community` schema. Carried in a config export so a restore reproduces the declaration rather than silently reverting it to the implementation default."
         },
+        "personhood": {
+          "$ref": "#/$defs/PersonhoodGovernance",
+          "description": "The community's published personhood position, carried so an export restores it. Governance state, not runtime state — unlike `registryStatus`, which is deliberately absent here because reachability belongs to a running maintainer rather than to exported state."
+        },
         "extensions": {
           "type": "object",
           "description": "Opaque community-defined extension bag."
@@ -385,6 +411,38 @@ export const PAYLOAD_SCHEMA = {
           "description": "When the community was created. Provenance only — an import never writes it."
         }
       }
+    },
+    "PersonhoodGovernance": {
+      "$anchor": "personhoodGovernance",
+      "title": "PersonhoodGovernance",
+      "type": "object",
+      "additionalProperties": false,
+      "description": "A community's published position on personhood.\n\nDTG Credentials §Personhood Credentials places PHC status here rather than in the credential — \"PHC status is determined by governance and trust registries, not by credential structure\" — so a verifier deciding whether a VMC carries personhood weight reads this, not the credential's type array. §Governance Considerations item 1 makes the acceptable-IDVP list the community's to define and publish.\n\nEvery member is a declaration, not an enforcement: what a community actually accepts is decided by its own policy. Absent means the community has not published a position, which is not the same as asserting the negative.",
+      "properties": {
+        "realHuman": {
+          "type": "boolean",
+          "description": "Governance requires that members are real humans. Defaults to `false` when absent: a community that has not considered the question asserts nothing, which is the only safe default for a claim a verifier may rely on."
+        },
+        "singleMembership": {
+          "type": "boolean",
+          "description": "Governance requires that each person holds at most one membership in **this** community. Per-community by definition — the glossary says \"exactly one membership in that VTC\" — so a single community can satisfy it without any network above it."
+        },
+        "acceptedIdvps": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "DIDs of the identity-verification providers whose credentials this community accepts as personhood evidence. A community that vets its own members in person lists its own community DID here — it is acting as its own IDVP, which §IDVC permits. An empty list means no list has been published, not that everything is accepted."
+        },
+        "governanceFrameworkUrl": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Where the governance framework these assertions refer to can be read."
+        }
+      }
     }
   }
 } as const;
@@ -595,6 +653,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           ],
           "description": "The community's declared relationship-identifier default, as defined on `CommunityProfile` in the `vtc/_shared/0.1/community` schema. Carried in a config export so a restore reproduces the declaration rather than silently reverting it to the implementation default."
         },
+        "personhood": {
+          "$ref": "#/$defs/PersonhoodGovernance",
+          "description": "The community's published personhood position, carried so an export restores it. Governance state, not runtime state — unlike `registryStatus`, which is deliberately absent here because reachability belongs to a running maintainer rather than to exported state."
+        },
         "extensions": {
           "type": "object",
           "description": "Opaque community-defined extension bag."
@@ -605,6 +667,38 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "description": "When the community was created. Provenance only — an import never writes it."
         }
       }
+    },
+    "PersonhoodGovernance": {
+      "$anchor": "personhoodGovernance",
+      "title": "PersonhoodGovernance",
+      "type": "object",
+      "additionalProperties": false,
+      "description": "A community's published position on personhood.\n\nDTG Credentials §Personhood Credentials places PHC status here rather than in the credential — \"PHC status is determined by governance and trust registries, not by credential structure\" — so a verifier deciding whether a VMC carries personhood weight reads this, not the credential's type array. §Governance Considerations item 1 makes the acceptable-IDVP list the community's to define and publish.\n\nEvery member is a declaration, not an enforcement: what a community actually accepts is decided by its own policy. Absent means the community has not published a position, which is not the same as asserting the negative.",
+      "properties": {
+        "realHuman": {
+          "type": "boolean",
+          "description": "Governance requires that members are real humans. Defaults to `false` when absent: a community that has not considered the question asserts nothing, which is the only safe default for a claim a verifier may rely on."
+        },
+        "singleMembership": {
+          "type": "boolean",
+          "description": "Governance requires that each person holds at most one membership in **this** community. Per-community by definition — the glossary says \"exactly one membership in that VTC\" — so a single community can satisfy it without any network above it."
+        },
+        "acceptedIdvps": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "DIDs of the identity-verification providers whose credentials this community accepts as personhood evidence. A community that vets its own members in person lists its own community DID here — it is acting as its own IDVP, which §IDVC permits. An empty list means no list has been published, not that everything is accepted."
+        },
+        "governanceFrameworkUrl": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Where the governance framework these assertions refer to can be read."
+        }
+      }
     }
   }
 } as const;

package/src/vtc/endorsements/issue/0.1/payload.ts

@@ -35,6 +35,10 @@ export interface Ext {
 }
 export interface VTCEndorsementsIssueResponsePayload {
   endorsement: Endorsement;
+  /**
+   * The signed VEC just minted. Present only here: handing back the credential is the point of an issue call, and the issuer is the only party that can. Reads carry `endorsement.issued` — the reference — instead.
+   */
+  credential: {};
   ext?: Ext;
 }
 export interface Endorsement {
@@ -54,7 +58,7 @@ export interface Endorsement {
    * The attested claim body, validated against the endorsement type's claimSchema when it declares one.
    */
   claim?: {};
-  issued: IssuedCredential;
+  issued: CredentialReference;
   /**
    * The endorsement's slot on the community's shared Revocation status list. Published, so a foreign verifier can check revocation without contacting this community.
    */
@@ -65,22 +69,18 @@ export interface Endorsement {
   revokedAt?: string | null;
 }
 /**
- * The registry-wide issuance receipt — credentialId, the signed VEC, and expiry.
+ * A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it.
  */
-export interface IssuedCredential {
+export interface CredentialReference {
   credentialId: CredentialId;
-  /**
-   * The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework.
-   */
-  credential: {};
   /**
    * When the credential was minted.
    */
   issuedAt?: string;
   /**
-   * When the credential's validUntil falls due.
+   * When it lapses, or null when it does not.
    */
-  expiresAt: string;
+  expiresAt?: string | null;
 }
 
 /** Trust Task type URI. */
@@ -148,12 +148,17 @@ export const PAYLOAD_SCHEMA = {
       "type": "object",
       "additionalProperties": false,
       "required": [
-        "endorsement"
+        "endorsement",
+        "credential"
       ],
       "properties": {
         "endorsement": {
           "$ref": "#/$defs/Endorsement"
         },
+        "credential": {
+          "type": "object",
+          "description": "The signed VEC just minted. Present only here: handing back the credential is the point of an issue call, and the issuer is the only party that can. Reads carry `endorsement.issued` — the reference — instead."
+        },
         "ext": {
           "$ref": "#/$defs/Ext"
         }
@@ -203,8 +208,8 @@ export const PAYLOAD_SCHEMA = {
           "description": "The attested claim body, validated against the endorsement type's claimSchema when it declares one."
         },
         "issued": {
-          "$ref": "#/$defs/IssuedCredential",
-          "description": "The registry-wide issuance receipt — credentialId, the signed VEC, and expiry."
+          "$ref": "#/$defs/CredentialReference",
+          "description": "A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it."
         },
         "statusListIndex": {
           "type": "integer",
@@ -221,34 +226,31 @@ export const PAYLOAD_SCHEMA = {
         }
       }
     },
-    "IssuedCredential": {
-      "$anchor": "issuedCredential",
-      "title": "IssuedCredential",
-      "description": "The receipt for a successfully-minted Verifiable Credential: a stable handle for revocation and audit, the signed credential itself, and when it lapses.\n\nSCOPE — this is an *issuance* receipt, returned by the party that minted the credential. It is not the shape for a *delivery* receipt, where a holder hands an already-issued credential to a party that stores it: such a task returns a receipt naming what was stored (see vtc/members/vmc and vtc/join-requests/accept) and MUST NOT echo the credential back to the party that just sent it. Reaching for this definition on a delivery task is the mistake this paragraph exists to prevent.\n\n`additionalProperties` is false, so a specification needing extra members cannot compose this by `$ref` — `allOf` evaluates each subschema against the whole object and this one would reject them. vta/credentials/issue is that case: its response is this shape plus `supersedes` and `ext`, and it therefore states the members inline while `$ref`-ing the shared CredentialId. That is deliberate, not drift.",
+    "CredentialReference": {
+      "$anchor": "credentialReference",
+      "title": "CredentialReference",
       "type": "object",
       "additionalProperties": false,
+      "description": "A pointer to an issued credential, without the credential itself.\n\nThe counterpart to IssuedCredential, for the far more common case of *reading about* a credential rather than being handed one. A listing that embedded the signed credential in every row would grow with the size of the credentials rather than the number of them — a page of fifty is megabytes — and a reader that only needs to know a credential exists, when it lapses, and how to revoke it does not need the bytes.\n\nThe holder can always fetch the credential itself by `credentialId`, and a verifier can check revocation from the row's status-list slot without either. Reach for IssuedCredential only at the moment of minting, where the caller has no other way to receive what was just made for them.",
       "required": [
-        "credentialId",
-        "credential",
-        "expiresAt"
+        "credentialId"
       ],
       "properties": {
         "credentialId": {
           "$ref": "#/$defs/CredentialId"
         },
-        "credential": {
-          "type": "object",
-          "description": "The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework."
-        },
         "issuedAt": {
           "type": "string",
           "format": "date-time",
           "description": "When the credential was minted."
         },
         "expiresAt": {
-          "type": "string",
+          "type": [
+            "string",
+            "null"
+          ],
           "format": "date-time",
-          "description": "When the credential's validUntil falls due."
+          "description": "When it lapses, or null when it does not."
         }
       }
     },
@@ -273,12 +275,17 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "type": "object",
       "additionalProperties": false,
       "required": [
-        "endorsement"
+        "endorsement",
+        "credential"
       ],
       "properties": {
         "endorsement": {
           "$ref": "#/$defs/Endorsement"
         },
+        "credential": {
+          "type": "object",
+          "description": "The signed VEC just minted. Present only here: handing back the credential is the point of an issue call, and the issuer is the only party that can. Reads carry `endorsement.issued` — the reference — instead."
+        },
         "ext": {
           "$ref": "#/$defs/Ext"
         }
@@ -328,8 +335,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "description": "The attested claim body, validated against the endorsement type's claimSchema when it declares one."
         },
         "issued": {
-          "$ref": "#/$defs/IssuedCredential",
-          "description": "The registry-wide issuance receipt — credentialId, the signed VEC, and expiry."
+          "$ref": "#/$defs/CredentialReference",
+          "description": "A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it."
         },
         "statusListIndex": {
           "type": "integer",
@@ -346,34 +353,31 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         }
       }
     },
-    "IssuedCredential": {
-      "$anchor": "issuedCredential",
-      "title": "IssuedCredential",
-      "description": "The receipt for a successfully-minted Verifiable Credential: a stable handle for revocation and audit, the signed credential itself, and when it lapses.\n\nSCOPE — this is an *issuance* receipt, returned by the party that minted the credential. It is not the shape for a *delivery* receipt, where a holder hands an already-issued credential to a party that stores it: such a task returns a receipt naming what was stored (see vtc/members/vmc and vtc/join-requests/accept) and MUST NOT echo the credential back to the party that just sent it. Reaching for this definition on a delivery task is the mistake this paragraph exists to prevent.\n\n`additionalProperties` is false, so a specification needing extra members cannot compose this by `$ref` — `allOf` evaluates each subschema against the whole object and this one would reject them. vta/credentials/issue is that case: its response is this shape plus `supersedes` and `ext`, and it therefore states the members inline while `$ref`-ing the shared CredentialId. That is deliberate, not drift.",
+    "CredentialReference": {
+      "$anchor": "credentialReference",
+      "title": "CredentialReference",
       "type": "object",
       "additionalProperties": false,
+      "description": "A pointer to an issued credential, without the credential itself.\n\nThe counterpart to IssuedCredential, for the far more common case of *reading about* a credential rather than being handed one. A listing that embedded the signed credential in every row would grow with the size of the credentials rather than the number of them — a page of fifty is megabytes — and a reader that only needs to know a credential exists, when it lapses, and how to revoke it does not need the bytes.\n\nThe holder can always fetch the credential itself by `credentialId`, and a verifier can check revocation from the row's status-list slot without either. Reach for IssuedCredential only at the moment of minting, where the caller has no other way to receive what was just made for them.",
       "required": [
-        "credentialId",
-        "credential",
-        "expiresAt"
+        "credentialId"
       ],
       "properties": {
         "credentialId": {
           "$ref": "#/$defs/CredentialId"
         },
-        "credential": {
-          "type": "object",
-          "description": "The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework."
-        },
         "issuedAt": {
           "type": "string",
           "format": "date-time",
           "description": "When the credential was minted."
         },
         "expiresAt": {
-          "type": "string",
+          "type": [
+            "string",
+            "null"
+          ],
           "format": "date-time",
-          "description": "When the credential's validUntil falls due."
+          "description": "When it lapses, or null when it does not."
         }
       }
     },

package/src/vtc/endorsements/list/0.1/payload.ts

@@ -66,7 +66,7 @@ export interface Endorsement {
    * The attested claim body, validated against the endorsement type's claimSchema when it declares one.
    */
   claim?: {};
-  issued: IssuedCredential;
+  issued: CredentialReference;
   /**
    * The endorsement's slot on the community's shared Revocation status list. Published, so a foreign verifier can check revocation without contacting this community.
    */
@@ -77,22 +77,18 @@ export interface Endorsement {
   revokedAt?: string | null;
 }
 /**
- * The registry-wide issuance receipt — credentialId, the signed VEC, and expiry.
+ * A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it.
  */
-export interface IssuedCredential {
+export interface CredentialReference {
   credentialId: CredentialId;
-  /**
-   * The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework.
-   */
-  credential: {};
   /**
    * When the credential was minted.
    */
   issuedAt?: string;
   /**
-   * When the credential's validUntil falls due.
+   * When it lapses, or null when it does not.
    */
-  expiresAt: string;
+  expiresAt?: string | null;
 }
 
 /** Trust Task type URI. */
@@ -231,8 +227,8 @@ export const PAYLOAD_SCHEMA = {
           "description": "The attested claim body, validated against the endorsement type's claimSchema when it declares one."
         },
         "issued": {
-          "$ref": "#/$defs/IssuedCredential",
-          "description": "The registry-wide issuance receipt — credentialId, the signed VEC, and expiry."
+          "$ref": "#/$defs/CredentialReference",
+          "description": "A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it."
         },
         "statusListIndex": {
           "type": "integer",
@@ -249,34 +245,31 @@ export const PAYLOAD_SCHEMA = {
         }
       }
     },
-    "IssuedCredential": {
-      "$anchor": "issuedCredential",
-      "title": "IssuedCredential",
-      "description": "The receipt for a successfully-minted Verifiable Credential: a stable handle for revocation and audit, the signed credential itself, and when it lapses.\n\nSCOPE — this is an *issuance* receipt, returned by the party that minted the credential. It is not the shape for a *delivery* receipt, where a holder hands an already-issued credential to a party that stores it: such a task returns a receipt naming what was stored (see vtc/members/vmc and vtc/join-requests/accept) and MUST NOT echo the credential back to the party that just sent it. Reaching for this definition on a delivery task is the mistake this paragraph exists to prevent.\n\n`additionalProperties` is false, so a specification needing extra members cannot compose this by `$ref` — `allOf` evaluates each subschema against the whole object and this one would reject them. vta/credentials/issue is that case: its response is this shape plus `supersedes` and `ext`, and it therefore states the members inline while `$ref`-ing the shared CredentialId. That is deliberate, not drift.",
+    "CredentialReference": {
+      "$anchor": "credentialReference",
+      "title": "CredentialReference",
       "type": "object",
       "additionalProperties": false,
+      "description": "A pointer to an issued credential, without the credential itself.\n\nThe counterpart to IssuedCredential, for the far more common case of *reading about* a credential rather than being handed one. A listing that embedded the signed credential in every row would grow with the size of the credentials rather than the number of them — a page of fifty is megabytes — and a reader that only needs to know a credential exists, when it lapses, and how to revoke it does not need the bytes.\n\nThe holder can always fetch the credential itself by `credentialId`, and a verifier can check revocation from the row's status-list slot without either. Reach for IssuedCredential only at the moment of minting, where the caller has no other way to receive what was just made for them.",
       "required": [
-        "credentialId",
-        "credential",
-        "expiresAt"
+        "credentialId"
       ],
       "properties": {
         "credentialId": {
           "$ref": "#/$defs/CredentialId"
         },
-        "credential": {
-          "type": "object",
-          "description": "The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework."
-        },
         "issuedAt": {
           "type": "string",
           "format": "date-time",
           "description": "When the credential was minted."
         },
         "expiresAt": {
-          "type": "string",
+          "type": [
+            "string",
+            "null"
+          ],
           "format": "date-time",
-          "description": "When the credential's validUntil falls due."
+          "description": "When it lapses, or null when it does not."
         }
       }
     },
@@ -373,8 +366,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "description": "The attested claim body, validated against the endorsement type's claimSchema when it declares one."
         },
         "issued": {
-          "$ref": "#/$defs/IssuedCredential",
-          "description": "The registry-wide issuance receipt — credentialId, the signed VEC, and expiry."
+          "$ref": "#/$defs/CredentialReference",
+          "description": "A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it."
         },
         "statusListIndex": {
           "type": "integer",
@@ -391,34 +384,31 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         }
       }
     },
-    "IssuedCredential": {
-      "$anchor": "issuedCredential",
-      "title": "IssuedCredential",
-      "description": "The receipt for a successfully-minted Verifiable Credential: a stable handle for revocation and audit, the signed credential itself, and when it lapses.\n\nSCOPE — this is an *issuance* receipt, returned by the party that minted the credential. It is not the shape for a *delivery* receipt, where a holder hands an already-issued credential to a party that stores it: such a task returns a receipt naming what was stored (see vtc/members/vmc and vtc/join-requests/accept) and MUST NOT echo the credential back to the party that just sent it. Reaching for this definition on a delivery task is the mistake this paragraph exists to prevent.\n\n`additionalProperties` is false, so a specification needing extra members cannot compose this by `$ref` — `allOf` evaluates each subschema against the whole object and this one would reject them. vta/credentials/issue is that case: its response is this shape plus `supersedes` and `ext`, and it therefore states the members inline while `$ref`-ing the shared CredentialId. That is deliberate, not drift.",
+    "CredentialReference": {
+      "$anchor": "credentialReference",
+      "title": "CredentialReference",
       "type": "object",
       "additionalProperties": false,
+      "description": "A pointer to an issued credential, without the credential itself.\n\nThe counterpart to IssuedCredential, for the far more common case of *reading about* a credential rather than being handed one. A listing that embedded the signed credential in every row would grow with the size of the credentials rather than the number of them — a page of fifty is megabytes — and a reader that only needs to know a credential exists, when it lapses, and how to revoke it does not need the bytes.\n\nThe holder can always fetch the credential itself by `credentialId`, and a verifier can check revocation from the row's status-list slot without either. Reach for IssuedCredential only at the moment of minting, where the caller has no other way to receive what was just made for them.",
       "required": [
-        "credentialId",
-        "credential",
-        "expiresAt"
+        "credentialId"
       ],
       "properties": {
         "credentialId": {
           "$ref": "#/$defs/CredentialId"
         },
-        "credential": {
-          "type": "object",
-          "description": "The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework."
-        },
         "issuedAt": {
           "type": "string",
           "format": "date-time",
           "description": "When the credential was minted."
         },
         "expiresAt": {
-          "type": "string",
+          "type": [
+            "string",
+            "null"
+          ],
           "format": "date-time",
-          "description": "When the credential's validUntil falls due."
+          "description": "When it lapses, or null when it does not."
         }
       }
     },

package/src/vtc/endorsements/show/0.1/payload.ts

@@ -39,7 +39,7 @@ export interface Endorsement {
    * The attested claim body, validated against the endorsement type's claimSchema when it declares one.
    */
   claim?: {};
-  issued: IssuedCredential;
+  issued: CredentialReference;
   /**
    * The endorsement's slot on the community's shared Revocation status list. Published, so a foreign verifier can check revocation without contacting this community.
    */
@@ -50,22 +50,18 @@ export interface Endorsement {
   revokedAt?: string | null;
 }
 /**
- * The registry-wide issuance receipt — credentialId, the signed VEC, and expiry.
+ * A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it.
  */
-export interface IssuedCredential {
+export interface CredentialReference {
   credentialId: CredentialId;
-  /**
-   * The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework.
-   */
-  credential: {};
   /**
    * When the credential was minted.
    */
   issuedAt?: string;
   /**
-   * When the credential's validUntil falls due.
+   * When it lapses, or null when it does not.
    */
-  expiresAt: string;
+  expiresAt?: string | null;
 }
 
 /** Trust Task type URI. */
@@ -169,8 +165,8 @@ export const PAYLOAD_SCHEMA = {
           "description": "The attested claim body, validated against the endorsement type's claimSchema when it declares one."
         },
         "issued": {
-          "$ref": "#/$defs/IssuedCredential",
-          "description": "The registry-wide issuance receipt — credentialId, the signed VEC, and expiry."
+          "$ref": "#/$defs/CredentialReference",
+          "description": "A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it."
         },
         "statusListIndex": {
           "type": "integer",
@@ -187,34 +183,31 @@ export const PAYLOAD_SCHEMA = {
         }
       }
     },
-    "IssuedCredential": {
-      "$anchor": "issuedCredential",
-      "title": "IssuedCredential",
-      "description": "The receipt for a successfully-minted Verifiable Credential: a stable handle for revocation and audit, the signed credential itself, and when it lapses.\n\nSCOPE — this is an *issuance* receipt, returned by the party that minted the credential. It is not the shape for a *delivery* receipt, where a holder hands an already-issued credential to a party that stores it: such a task returns a receipt naming what was stored (see vtc/members/vmc and vtc/join-requests/accept) and MUST NOT echo the credential back to the party that just sent it. Reaching for this definition on a delivery task is the mistake this paragraph exists to prevent.\n\n`additionalProperties` is false, so a specification needing extra members cannot compose this by `$ref` — `allOf` evaluates each subschema against the whole object and this one would reject them. vta/credentials/issue is that case: its response is this shape plus `supersedes` and `ext`, and it therefore states the members inline while `$ref`-ing the shared CredentialId. That is deliberate, not drift.",
+    "CredentialReference": {
+      "$anchor": "credentialReference",
+      "title": "CredentialReference",
       "type": "object",
       "additionalProperties": false,
+      "description": "A pointer to an issued credential, without the credential itself.\n\nThe counterpart to IssuedCredential, for the far more common case of *reading about* a credential rather than being handed one. A listing that embedded the signed credential in every row would grow with the size of the credentials rather than the number of them — a page of fifty is megabytes — and a reader that only needs to know a credential exists, when it lapses, and how to revoke it does not need the bytes.\n\nThe holder can always fetch the credential itself by `credentialId`, and a verifier can check revocation from the row's status-list slot without either. Reach for IssuedCredential only at the moment of minting, where the caller has no other way to receive what was just made for them.",
       "required": [
-        "credentialId",
-        "credential",
-        "expiresAt"
+        "credentialId"
       ],
       "properties": {
         "credentialId": {
           "$ref": "#/$defs/CredentialId"
         },
-        "credential": {
-          "type": "object",
-          "description": "The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework."
-        },
         "issuedAt": {
           "type": "string",
           "format": "date-time",
           "description": "When the credential was minted."
         },
         "expiresAt": {
-          "type": "string",
+          "type": [
+            "string",
+            "null"
+          ],
           "format": "date-time",
-          "description": "When the credential's validUntil falls due."
+          "description": "When it lapses, or null when it does not."
         }
       }
     },
@@ -294,8 +287,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "description": "The attested claim body, validated against the endorsement type's claimSchema when it declares one."
         },
         "issued": {
-          "$ref": "#/$defs/IssuedCredential",
-          "description": "The registry-wide issuance receipt — credentialId, the signed VEC, and expiry."
+          "$ref": "#/$defs/CredentialReference",
+          "description": "A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it."
         },
         "statusListIndex": {
           "type": "integer",
@@ -312,34 +305,31 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         }
       }
     },
-    "IssuedCredential": {
-      "$anchor": "issuedCredential",
-      "title": "IssuedCredential",
-      "description": "The receipt for a successfully-minted Verifiable Credential: a stable handle for revocation and audit, the signed credential itself, and when it lapses.\n\nSCOPE — this is an *issuance* receipt, returned by the party that minted the credential. It is not the shape for a *delivery* receipt, where a holder hands an already-issued credential to a party that stores it: such a task returns a receipt naming what was stored (see vtc/members/vmc and vtc/join-requests/accept) and MUST NOT echo the credential back to the party that just sent it. Reaching for this definition on a delivery task is the mistake this paragraph exists to prevent.\n\n`additionalProperties` is false, so a specification needing extra members cannot compose this by `$ref` — `allOf` evaluates each subschema against the whole object and this one would reject them. vta/credentials/issue is that case: its response is this shape plus `supersedes` and `ext`, and it therefore states the members inline while `$ref`-ing the shared CredentialId. That is deliberate, not drift.",
+    "CredentialReference": {
+      "$anchor": "credentialReference",
+      "title": "CredentialReference",
       "type": "object",
       "additionalProperties": false,
+      "description": "A pointer to an issued credential, without the credential itself.\n\nThe counterpart to IssuedCredential, for the far more common case of *reading about* a credential rather than being handed one. A listing that embedded the signed credential in every row would grow with the size of the credentials rather than the number of them — a page of fifty is megabytes — and a reader that only needs to know a credential exists, when it lapses, and how to revoke it does not need the bytes.\n\nThe holder can always fetch the credential itself by `credentialId`, and a verifier can check revocation from the row's status-list slot without either. Reach for IssuedCredential only at the moment of minting, where the caller has no other way to receive what was just made for them.",
       "required": [
-        "credentialId",
-        "credential",
-        "expiresAt"
+        "credentialId"
       ],
       "properties": {
         "credentialId": {
           "$ref": "#/$defs/CredentialId"
         },
-        "credential": {
-          "type": "object",
-          "description": "The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework."
-        },
         "issuedAt": {
           "type": "string",
           "format": "date-time",
           "description": "When the credential was minted."
         },
         "expiresAt": {
-          "type": "string",
+          "type": [
+            "string",
+            "null"
+          ],
           "format": "date-time",
-          "description": "When the credential's validUntil falls due."
+          "description": "When it lapses, or null when it does not."
         }
       }
     },