@openvtc/trust-tasks 0.26.25 → 0.26.27

package/CHANGELOG.md

@@ -11,6 +11,98 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.26.27 — 2026-10-21
+
+
+### Added
+
+- **vtc/config**: Did-hosting/list 0.1 — the hosting servers the community's VTA can publish its identities through (#849)
+
+A community's administrator chooses where the identities it mints (its groups'
+  and its own rooms') are published. The community either serves each `did:webvh`
+  log itself, or has its VTA publish it on a hosting server registered there.
+  Without a list of those servers the choice is typed blind.
+
+  - vtc/config/did-hosting/list/0.1: for holders of `vtc.config.admin`. The
+    community asks its own VTA (`vta/webvh/servers/list`), as itself, over the
+    link it keeps to it. It answers with each server's `id`, `did` and `label`,
+    and nothing else of the VTA's record. A server whose id the configuration
+    could not name is left out.
+  - Codes: noKeyHolder (no VTA link), keyHolderUnavailable (no answer,
+    retryable), keyHolderRefused (the VTA's own code and message in `details`).
+
+
+
+### Fixed
+
+- **voting**: Encrypted elections on a private board — trustees read their ceremony, voters get the key from vtc/elections/show (#852)
+
+On a private board the ballot box answered voting/trustees/status only to the community and
+  its auditors, so no trustee could take its next step (transport keys, dealings and targets are
+  read from status) and no voter could obtain the election key: a sealed or tallied-encrypted
+  election on a private board could not run.
+
+  - CONVENTIONS §4 gains the rows the trustee tasks were missing; voting/trustees/status
+    answers every trustee the manifest names on any board. Nothing the ceremony publishes is
+    secret (§9.6, "Who reads the ceremony").
+  - vtc/elections/show carries electionKey (optional, appended) once formed, read from the
+    ballot box and refused unless the qualified dealings in the same answer form it. A voter
+    gets it from the community it already asks for its ticket.
+
+## 0.26.26 — 2026-10-20
+
+
+### Added
+
+- **rooms**: Rooms/keys/read repairs before refusing — catches up on commits and fetches links, then cannotOpen with a reason (#848)
+
+A key holder misses an epoch key in two ordinary ways — behind by a commit after any
+  membership change, or joined late and holding nothing older — and the member's surface
+  reaches only their agent, so the agent is the one party that can repair either.
+
+  The recipient now SHOULD, before answering cannotOpen, fetch the commits the host relays
+  (rooms/epoch/commits) and apply them in order, or fetch the epoch links as backfill does,
+  from the same host, as the same principal, under the same read grant; at most once per
+  request, serialised per member, never for a removed principal. cannotOpen carries
+  details.reason (notDelivered / beyondChain / removed) in rooms/keys/open 0.2's words.
+  sideEffects becomes mutating: the room is unchanged, the recipient's key state is not.
+
+- **voting**: Sealed and tallied-encrypted elections — trustees, encrypted casts, VTA trustee role (#845)
+
+* feat(voting): sealed and tallied-encrypted elections — voting/trustees/*, voting/ballot/cast-encrypted, vta/pcs/trustee/* and vta/pcs/vote-encrypted
+
+  The encrypted secrecy levels (VTI-VOT-060 – 064). CONVENTIONS §9 fixes the
+  cryptography: Ristretto255, exponential ElGamal under a threshold key, and
+  Fiat–Shamir Schnorr, Chaum–Pedersen and disjunctive proofs with their domains.
+
+  The trustees generate the election key on the board (Pedersen DKG with
+  Belenios-style complaints): enrol a transport key, deal (Feldman commitments
+  plus every share sealed to its recipient), confirm or complain, and a dealer
+  complained of justifies by revealing the share. The key forms from the
+  qualified dealers. After close, each trustee publishes partial decryptions of
+  every sealed cast's KEM, or of every option's homomorphic total, with
+  Chaum–Pedersen proofs; voting/trustees/status tells everyone what is left.
+
+  voting/ballot/cast-encrypted admits a cast whose attestation binds the sealed
+  payload or the encrypted ballot, the latter with 0/1 proofs per option and a
+  proof that each question's count is admissible.
+
+  vta/pcs/trustee/{enrol,deal,keys,justify,decrypt} make the trustee's VTA the
+  custodian of its transport key and key share, signing only the task's own
+  document as the trustee; vta/pcs/vote-encrypted is vta/pcs/vote for the
+  encrypted levels. The new capability pcsTrustee / pcs-trustee is appended to
+  both device/_shared Capability enums.
+
+
+
+### Fixed
+
+- **vtc/elections**: Create serves the encrypted levels a community certifies (#847)
+
+* fix(vtc/elections): create serves the encrypted levels a community certifies, and holds them to their trustee rules
+
+  Item 3: unsupportedSecrecy names a level the community does not serve; a community serving sealed or talliedEncrypted refuses a manifest that breaks the trustee rules with invalidManifest.
+
 ## 0.26.25 — 2026-10-20
 
 

package/dist/_shared/components.d.ts

@@ -388,7 +388,7 @@ export type BlobRef = DigestMultibase;
 /**
  * One leaf of a board. A leaf's hash is the RFC 9162 leaf hash of the JCS canonicalization of this object. Entries carry no time of arrival: the order is the board's, and a timestamp would hand anyone who reads the board the timing the registrar's log would need to pair a ticket with its cast.
  */
-export type BoardEntry = CastEntry | ReplacementEntry | LifecycleEntry | ResultEntry;
+export type BoardEntry = CastEntry | ReplacementEntry | LifecycleEntry | ResultEntry | EncryptedCastEntry | TransportKeyEntry | DealingEntry | ConfirmationEntry | JustificationEntry | ElectionKeyEntry | PartialDecryptionsEntry | UnsealedEntry | SpoiledEntry;
 /**
  * `public`: anyone reads the board. `private`: the community, the auditors the manifest names and, for one cast's inclusion, the holder of its receipt (VTI-VOT-052).
  */
@@ -416,11 +416,11 @@ export type Capability_AclV0_2 = string;
 /**
  * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything.
  */
-export type Capability_DeviceV0_1 = "vault-read" | "vault-write" | "proxy-login" | "fill-release" | "policy-admin" | "device-admin" | "sign" | "key-mint" | "sign-trust-task" | "credential-write" | "memory-read" | "memory-write" | "room-present" | "room-open" | "key-export" | "sign-sshsig" | "sign-jws" | "sign-csr" | "sign-document" | "external-accounts-manage" | "external-auth-use" | "pcs-vetter" | "pcs-applicant" | "witness-request" | "pcs-voter";
+export type Capability_DeviceV0_1 = "vault-read" | "vault-write" | "proxy-login" | "fill-release" | "policy-admin" | "device-admin" | "sign" | "key-mint" | "sign-trust-task" | "credential-write" | "memory-read" | "memory-write" | "room-present" | "room-open" | "key-export" | "sign-sshsig" | "sign-jws" | "sign-csr" | "sign-document" | "external-accounts-manage" | "external-auth-use" | "pcs-vetter" | "pcs-applicant" | "witness-request" | "pcs-voter" | "pcs-trustee";
 /**
  * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything.
  */
-export type Capability_DeviceV0_2 = "vaultRead" | "vaultWrite" | "proxyLogin" | "fillRelease" | "policyAdmin" | "deviceAdmin" | "sign" | "keyMint" | "signTrustTask" | "credentialWrite" | "memoryRead" | "memoryWrite" | "roomPresent" | "roomOpen" | "keyExport" | "signSshsig" | "signJws" | "signCsr" | "signDocument" | "externalAccountsManage" | "externalAuthUse" | "pcsVetter" | "pcsApplicant" | "witnessRequest" | "pcsVoter";
+export type Capability_DeviceV0_2 = "vaultRead" | "vaultWrite" | "proxyLogin" | "fillRelease" | "policyAdmin" | "deviceAdmin" | "sign" | "keyMint" | "signTrustTask" | "credentialWrite" | "memoryRead" | "memoryWrite" | "roomPresent" | "roomOpen" | "keyExport" | "signSshsig" | "signJws" | "signCsr" | "signDocument" | "externalAccountsManage" | "externalAuthUse" | "pcsVetter" | "pcsApplicant" | "witnessRequest" | "pcsVoter" | "pcsTrustee";
 /**
  * Number of chunks in the bundle, equal to ceil(expectedSizeBytes / chunkSize). Bounded at 4096 so that the manifest itself — one digest per chunk — fits in the single document that carries it under the same message-size reasoning as a chunk.
  */
@@ -514,6 +514,12 @@ export type DataCommitment = DigestMultibase;
  * The approver's answer. `deny` aborts the pending request; a subsequent submit of the same task starts a fresh one.
  */
 export type Decision = "approve" | "deny";
+/**
+ * What a partial decryption decrypts: the sealed cast at a board leaf, or the total of one option of one question.
+ */
+export type DecryptionTarget = {
+    [k: string]: unknown | undefined;
+};
 /**
  * `queued`: stored and not yet handed to the recipient. `delivered`: handed to the recipient (pickup or live stream) but not yet deleted by it — the recipient has not acknowledged it.
  */
@@ -556,6 +562,13 @@ export type DigestMultibase = string;
  * A community directory entry's identifier, exactly as that community's directory returned it. Opaque and community-scoped: the agent stores and compares it as a string, never parses it, and never treats the same value under two communities as the same entry.
  */
 export type DirectoryEntryId = string;
+/**
+ * A disjunctive proof that a ciphertext encrypts one value of a public list: one `(c, z)` per value, in the list's order (CONVENTIONS §9.3).
+ *
+ * @minItems 1
+ * @maxItems 65
+ */
+export type DisjunctiveProof = [SigmaProof, ...SigmaProof[]];
 /**
  * The kinds of drift, named so that a task can select a drift item by kind. The same values, with the same meanings, as `DriftItem`'s `type`, which keeps its own inline list so that `DriftItem` stays textually identical to 0.1; the two lists change together. `roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone.
  */
@@ -581,6 +594,12 @@ export type ElectionState = "registered" | "registration" | "voting" | "closed"
  * The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.
  */
 export type ElevatedRight = "git.ns.admin" | "git.repo.create" | "git.repo.own";
+/**
+ * A cast of a sealed or tallied-encrypted election: exactly one of `sealed` (the Ballot's JCS bytes sealed to the election key) or `encrypted`, with the tag and the attestation over the JCS bytes of whichever is present (CONVENTIONS §3.6, §9.5).
+ */
+export type EncryptedCast = {
+    [k: string]: unknown | undefined;
+};
 /**
  * The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.
  */
@@ -704,6 +723,10 @@ export type GroupCredentialId = string;
  * What the group is for. Plain text; a reader MUST NOT treat it as instructions. Same placement rules as `GroupName`.
  */
 export type GroupDescription = string;
+/**
+ * A Ristretto group element: its 32-byte compression, multibase base58btc. Never the identity (CONVENTIONS §9.1).
+ */
+export type GroupElement = string;
 /**
  * Opaque identifier of a community group: `grp_` followed by 16 to 64 base64url characters. Random and community-scoped; not the group's DID.
  */
@@ -716,6 +739,10 @@ export type GroupKind = "static" | "dynamic";
  * The group's name, shown to those who may see the group. The community's own record: never in the group's DID document or its credentials' subject beyond the group's DID. Plain text.
  */
 export type GroupName = string;
+/**
+ * A scalar mod the Ristretto group order: 32 canonical little-endian bytes, multibase base58btc (CONVENTIONS §9.1).
+ */
+export type GroupScalar = string;
 /**
  * The Farm-generated handle of one reservation: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is what VTI-LNK-116 recommends). It is the `_id` of the trigger link (VTI-LNK-033) and is compared as a string. In a claim it MUST equal the document's `parentThreadId`. It confers no authority on its holder beyond the right to make one claim.
  */
@@ -1379,7 +1406,7 @@ export type SealedEnvelope_VaultV0_2 = DidcommAuthcryptEnvelope_VaultV0_2 | Hpke
  */
 export type SealedTransferBundle = string;
 /**
- * `open`: ballots are recorded on the board as cast. `sealed`: ballots are encrypted to a jointly generated election key and decrypted after voting closes. `talliedEncrypted`: ballots are encrypted and only the totals are ever decrypted (VTI-VOT-060). Version 0.1 of the voting tasks carries open ballots only; a ballot box refuses to register any other level with `voting/election/register:unsupportedSecrecy` until the trustee tasks are specified.
+ * `open`: ballots are recorded on the board as cast. `sealed`: ballots are encrypted to a jointly generated election key and decrypted after voting closes. `talliedEncrypted`: ballots are encrypted and only the totals are ever decrypted (VTI-VOT-060). The encrypted levels are cast with `voting/ballot/cast-encrypted/0.1`, under an election key the trustees generate with `voting/trustees/*` (CONVENTIONS §9).
  */
 export type SecrecyLevel = "open" | "sealed" | "talliedEncrypted";
 /**
@@ -1545,6 +1572,14 @@ export type TransferId = string;
  * How a blob's bytes move. `proxied`: through the host, as chunk documents (rooms/blobs/upload/chunk, rooms/blobs/chunk). `direct`: straight between the member and the storage the room is assigned to, over time-limited URLs the host issues for one object and one method each; the host authorizes every object and verifies every upload, and never carries a byte. Which mode applies is the host's answer, from what the producer accepts, what the room's storage can do, and the room's tier.
  */
 export type TransferMode = "direct" | "proxied";
+/**
+ * A trustee's index: its position in the manifest's `trustees.dids`, counting from 1.
+ */
+export type TrusteeIndex = number;
+/**
+ * `enrolling`: transport keys are being published. `dealing`: dealings are. `confirming`: each trustee confirms or complains. `keyed`: the election key is formed. `decrypting`: voting has closed and partial decryptions are being published. `done`: every target is decrypted. `failed`: the key could not be formed in time.
+ */
+export type TrusteePhase = "enrolling" | "dealing" | "confirming" | "keyed" | "decrypting" | "done" | "failed";
 /**
  * A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.
  */
@@ -4535,6 +4570,57 @@ export interface ResultEntry {
     kind: "result";
     result: ElectionResult;
 }
+export interface EncryptedCastEntry {
+    kind: "encryptedCast";
+    cast: EncryptedCast;
+}
+export interface TransportKeyEntry {
+    kind: "transportKey";
+    transportKey: TransportKey;
+}
+export interface DealingEntry {
+    kind: "dealing";
+    dealing: Dealing;
+}
+export interface ConfirmationEntry {
+    kind: "confirmation";
+    trustee: TrusteeIndex;
+    /**
+     * @maxItems 64
+     */
+    complaints: TrusteeIndex[];
+}
+export interface JustificationEntry {
+    kind: "justification";
+    dealer: TrusteeIndex;
+    recipient: TrusteeIndex;
+    share: GroupScalar;
+}
+export interface ElectionKeyEntry {
+    kind: "electionKey";
+    electionKey: ElectionKey;
+}
+export interface PartialDecryptionsEntry {
+    kind: "partials";
+    trustee: TrusteeIndex;
+    /**
+     * @minItems 1
+     * @maxItems 100000
+     */
+    partials: [PartialDecryption, ...PartialDecryption[]];
+}
+export interface UnsealedEntry {
+    kind: "unsealed";
+    leafIndex: number;
+    ballot: Ballot;
+}
+/**
+ * A sealed cast that did not open, or opened to no valid ballot: not counted (CONVENTIONS §9.7).
+ */
+export interface SpoiledEntry {
+    kind: "spoiled";
+    leafIndex: number;
+}
 /**
  * A board's tree head (RFC 9162 §2.1). A head is signed by being carried in a document the ballot box signs; whoever keeps a head keeps that whole document.
  */
@@ -5379,6 +5465,23 @@ export interface DataIntegrityProof {
 export interface DcqlQuery {
     [k: string]: unknown | undefined;
 }
+/**
+ * A trustee's contribution to the election key: Feldman commitments to its polynomial, a proof of knowledge of the constant term, and one share per trustee sealed to that trustee's transport key (CONVENTIONS §9.6).
+ */
+export interface Dealing {
+    dealer: TrusteeIndex;
+    /**
+     * @minItems 2
+     * @maxItems 64
+     */
+    commitments: [GroupElement, GroupElement, ...GroupElement[]];
+    pok: SigmaProof;
+    /**
+     * @minItems 2
+     * @maxItems 64
+     */
+    shares: [SealedShare, SealedShare, ...SealedShare[]];
+}
 /**
  * One presentation request awaiting the holder's decision, as the approver sees it.
  *
@@ -6297,6 +6400,44 @@ export interface EffectiveLimits {
      */
     hostCeilingBytes?: number;
 }
+/**
+ * `(a, b) = (r·G, M + r·Y)` under the election key `Y` (CONVENTIONS §9.2).
+ */
+export interface ElGamalCiphertext {
+    a: GroupElement;
+    b: GroupElement;
+}
+/**
+ * The election key and each trustee's public verification key, computed from the qualified dealings (CONVENTIONS §9.6). Anyone can recompute it from the board.
+ */
+export interface ElectionKey {
+    key: GroupElement;
+    /**
+     * The dealers whose dealings the key is formed from.
+     *
+     * @minItems 1
+     * @maxItems 64
+     */
+    qualified: [TrusteeIndex, ...TrusteeIndex[]];
+    /**
+     * @minItems 2
+     * @maxItems 64
+     */
+    verification: [
+        {
+            trustee: TrusteeIndex;
+            key: GroupElement;
+        },
+        {
+            trustee: TrusteeIndex;
+            key: GroupElement;
+        },
+        ...{
+            trustee: TrusteeIndex;
+            key: GroupElement;
+        }[]
+    ];
+}
 /**
  * An election's result, computable by anyone who can read its board from the board and the registration alone (VTI-VOT-070).
  */
@@ -6324,6 +6465,34 @@ export interface ElectionSummary {
     ballotsAdmitted: number;
     head: BoardHead;
 }
+/**
+ * A tallied-encrypted ballot: one EncryptedQuestion per manifest question, in the manifest's order. Never decrypted (VTI-VOT-064).
+ */
+export interface EncryptedBallot {
+    electionId: ElectionId;
+    manifestDigest: DigestMultibase;
+    /**
+     * @minItems 1
+     * @maxItems 64
+     */
+    questions: [EncryptedQuestion, ...EncryptedQuestion[]];
+}
+export interface EncryptedOption {
+    ciphertext: ElGamalCiphertext;
+    proof: DisjunctiveProof;
+}
+/**
+ * One choice question of a tallied-encrypted ballot: per option, in the manifest's order, an encryption of 0 or 1 with its proof; and a proof that the selections sum to a count the question admits (CONVENTIONS §9.5).
+ */
+export interface EncryptedQuestion {
+    question: Key_VotingV0_1;
+    /**
+     * @minItems 1
+     * @maxItems 64
+     */
+    options: [EncryptedOption, ...EncryptedOption[]];
+    sumProof: DisjunctiveProof;
+}
 export interface EncryptionParams {
     /**
      * AEAD identifier, e.g. `aes-256-gcm`.
@@ -7900,6 +8069,14 @@ export interface PartPlan {
      */
     partDigests: [DigestMultibase, ...DigestMultibase[]];
 }
+/**
+ * Trustee `trustee`'s share of one decryption, `d = x_j·a`, with a Chaum–Pedersen proof against its verification key (CONVENTIONS §9.7).
+ */
+export interface PartialDecryption {
+    target: DecryptionTarget;
+    d: GroupElement;
+    proof: SigmaProof;
+}
 export interface PasskeyVerificationMethod {
     /**
      * The verificationMethod id as it appears in the DID document: `<did>#passkey-<base64url(sha256(credentialId))>`. The fragment is content-derived so a verifier can locate this VM by recomputing `sha256(credential.id)`.
@@ -9517,6 +9694,13 @@ export interface Context_VtaV0_1 {
     type: "context";
     contextId: string;
 }
+/**
+ * Bytes sealed to a key: a random group element encrypted as `kem`, and the bytes under ChaCha20-Poly1305 with a key derived from it, multibase base58btc (CONVENTIONS §9.4).
+ */
+export interface SealedPayload {
+    kem: ElGamalCiphertext;
+    body: string;
+}
 /**
  * A record as a host stores it on an `attributed` or `private` room. Title, description, body, author and tags are sealed together in one blob rather than separately: splitting them would let a host learn the shape of the material from ciphertext lengths, for no benefit, since a reader decrypts the whole record either way.
  */
@@ -9542,6 +9726,10 @@ export interface SealedRecord {
      */
     version?: number;
 }
+export interface SealedShare {
+    recipient: TrusteeIndex;
+    share: SealedPayload;
+}
 /**
  * Who the service says it is.
  */
@@ -9803,6 +9991,13 @@ export interface Session_AuthV0_3 {
      */
     ext?: Ext;
 }
+/**
+ * A non-interactive sigma proof as its challenge and response `(c, z)` (Schnorr or Chaum–Pedersen; CONVENTIONS §9.3).
+ */
+export interface SigmaProof {
+    c: GroupScalar;
+    z: GroupScalar;
+}
 /**
  * One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.
  */
@@ -10323,6 +10518,14 @@ export interface TransferTarget {
      */
     expiresAt: string;
 }
+/**
+ * The group element a trustee's shares are sealed to, with a Schnorr proof of knowledge of its discrete log (CONVENTIONS §9.6).
+ */
+export interface TransportKey {
+    trustee: TrusteeIndex;
+    key: GroupElement;
+    pok: SigmaProof;
+}
 export interface TransportObservation {
     /**
      * The binding the document actually travelled on.