@openvtc/trust-tasks 0.26.29 → 0.27.1

package/CHANGELOG.md

@@ -11,6 +11,70 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.27.1 — 2026-10-21
+
+
+### Fixed
+
+- **voting**: Trustees and voters act only on signed evidence; the community authorizes decryption; the key needs t dealers; ballots bind their tag (#860)
+
+* fix(voting): trustees and voters act only on signed evidence; the community authorizes what is decrypted; the key needs t dealers; ballots bind their tag; the board is in order
+
+  An adversarial review of community voting found that a dishonest ballot box could take the
+  trustees' place, and a single corrupt trustee could hold the election key.
+
+  - **The box could feed the trustees' VTAs.** They acted on values voting/trustees/status reported,
+    which carry no trustee's proof. The box could:
+    - substitute transport keys, and open the shares sealed to them;
+    - invent complaints, and collect the shares revealed in answer;
+    - replace dealings, and overwrite a key share;
+    - list one voter's ciphertexts as a "total", or a cast before the close, and collect honest
+      trustees' partials of it.
+  - **One trustee could hold the key.** The key formed from a single qualified dealer, so a corrupt
+    trustee complaining of every other dealer at the last moment was left holding it alone.
+  - **The voter's VTA took any key.** It encrypted under whatever key it was handed, so a community
+    could give one member a key it held.
+  - **Ballots could be copied.** Nothing bound a ballot to its cast: a voter could re-cast another's
+    encrypted ballot verbatim under their own tag (Cortier–Smyth).
+  - **Certification ignored the lifecycle.** It accepted casts after close, a result before it, and
+    an early close a manifest forbade.
+
+  The changes:
+
+  - **vta/pcs/trustee/{deal,keys,justify,decrypt}/0.2 and vta/pcs/vote-encrypted/0.2** (the 0.1
+    versions retire) take the ceremony as its signed steps, which status now carries as `steps`. The
+    VTA verifies each step itself (CONVENTIONS §9.6). In particular:
+    - deal pins the transport keys it dealt to;
+    - justify needs the complainant's own confirm;
+    - keys never replaces a held share;
+    - the voter's VTA forms the key itself;
+    - vtc/elections/show carries `ceremony` for it.
+  - **voting/trustees/authorize/0.1 (new).** After close the community computes the decryption
+    targets from the board it checked, and signs their digest under the closing head. The box
+    accepts it only if its own targets match, and appends a `decryptionAuthorized` entry. A
+    trustee's VTA decrypts only an authorized set, once (decrypt/0.2). The box refuses partials
+    before an authorization.
+  - **CONVENTIONS §9.6 item 5:** the key forms only from at least t qualified dealers, with at least
+    t confirmations.
+  - **§9.3/§9.4:** an encrypted form's proofs, and a sealed form's AAD, bind the cast's tag. The box
+    refuses a form whose ciphertexts are already on the board under another tag.
+  - **§3.9 (new):** the board's order — opened, casts, close, authorization, partials, one result
+    whose head is the board before it — enforced at certification (`orderInvalid`,
+    `ceremonyInvalid` appended to boardInconsistent's faults).
+
+## 0.27.0 — 2026-10-21
+
+
+### Added
+
+- **persona**: Star a directory member whose DID you have not been shown — persona/contact/put/1.1 linking form (#858)
+
+A community directory shows members' DIDs to other members only where each member chooses to, so most entries a holder reads carry no DID to file a contact under, and persona/contact/put/1.1 required one (subjectDid) to keep a star, a petname or a list on anyone.
+
+  put/1.1 gains a third form, LINKING: directoryRef + knownByPersona, without contactId, subjectDid, document or credentialRefs. The agent finds the contact it keeps for that directory entry and persona, or makes one (rev 1, an empty document, no subjectDid), and appends no revision. A later filing naming the member's DID is a contact of its own and is not merged with the linked one (item 4, extended). Two invalid examples pin the form's edges.
+
+  get/1.1 and list/1.1 responses: subjectDid is no longer required — absent for a linked contact.
+
 ## 0.26.29 — 2026-10-21
 
 

package/dist/_shared/components.d.ts

@@ -388,7 +388,7 @@ export type BlobRef = DigestMultibase;
 /**
  * One leaf of a board. A leaf's hash is the RFC 9162 leaf hash of the JCS canonicalization of this object. Entries carry no time of arrival: the order is the board's, and a timestamp would hand anyone who reads the board the timing the registrar's log would need to pair a ticket with its cast.
  */
-export type BoardEntry = CastEntry | ReplacementEntry | LifecycleEntry | ResultEntry | EncryptedCastEntry | TransportKeyEntry | DealingEntry | ConfirmationEntry | JustificationEntry | ElectionKeyEntry | PartialDecryptionsEntry | UnsealedEntry | SpoiledEntry | TrusteeStepEntry;
+export type BoardEntry = CastEntry | ReplacementEntry | LifecycleEntry | ResultEntry | EncryptedCastEntry | TransportKeyEntry | DealingEntry | ConfirmationEntry | JustificationEntry | ElectionKeyEntry | PartialDecryptionsEntry | UnsealedEntry | SpoiledEntry | TrusteeStepEntry | DecryptionAuthorizedEntry;
 /**
  * `public`: anyone reads the board. `private`: the community, the auditors the manifest names and, for one cast's inclusion, the holder of its receipt (VTI-VOT-052).
  */
@@ -1572,6 +1572,13 @@ export type TransferId = string;
  * How a blob's bytes move. `proxied`: through the host, as chunk documents (rooms/blobs/upload/chunk, rooms/blobs/chunk). `direct`: straight between the member and the storage the room is assigned to, over time-limited URLs the host issues for one object and one method each; the host authorizes every object and verifies every upload, and never carries a byte. Which mode applies is the host's answer, from what the producer accepts, what the room's storage can do, and the room's tier.
  */
 export type TransferMode = "direct" | "proxied";
+/**
+ * The trustees' ceremony as the board holds it: the `request` of every `trusteeStep` entry, in board order, each exactly as the ballot box received it (CONVENTIONS §9.6). Whoever acts on it verifies each step as its trustee's before taking it; nothing in it is believed for having been passed along.
+ *
+ * @minItems 1
+ * @maxItems 4224
+ */
+export type TrusteeCeremony = [SignedRequest, ...SignedRequest[]];
 /**
  * A trustee's index: its position in the manifest's `trustees.dids`, counting from 1.
  */
@@ -4640,6 +4647,13 @@ export interface TrusteeStepEntry {
     kind: "trusteeStep";
     request: SignedRequest;
 }
+/**
+ * The community's voting/trustees/authorize request, exactly as the ballot box received it: the decryption targets of a closed election, pinned by digest to a head of the board (CONVENTIONS §9.7).
+ */
+export interface DecryptionAuthorizedEntry {
+    kind: "decryptionAuthorized";
+    request: SignedRequest;
+}
 /**
  * A board's tree head (RFC 9162 §2.1). A head is signed by being carried in a document the ballot box signs; whoever keeps a head keeps that whole document.
  */