@openvtc/trust-tasks 0.28.13 → 0.28.15

package/CHANGELOG.md

@@ -11,6 +11,128 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.28.15 — 2026-11-05
+
+
+### Added
+
+- **rooms/keys**: Rooms/keys/watch and rooms/keys/changed — a key holder watches rooms for its member's wallet; act 0.12 lists rooms/watch (#1040)
+
+A wallet whose member keys are held by its key holder cannot present as
+  the member and has no address a host can reach, so it could not use
+  rooms/watch (#1036).
+
+- **did-management/stats/set-resolution**: Choose a slot's statistics resolution (#1041)
+
+An owner can keep less statistical detail over time for their own DID (coarse, or totals only), or return it to the service's own choice; an administrator can set any level for any slot, including always keeping the finest series. Bindings regenerated.
+
+
+
+### Specifications
+
+- **vtc/elections**: A deleted group's DID is never a member party (VTI-VOT-029) (#1039)
+
+vtc/elections/show/0.6, vtc/elections/list/0.5 and
+  vtc/elections/tickets/issue/0.3 defined a member party as a
+  `roll.memberOf` that is "neither the community's own DID nor one of its
+  groups". Once a group is deleted its DID is no longer one of the
+  community's groups, so read literally the definition let the election
+  fall onto the member-party presentation path, where a holder of an
+  unexpired credential the deleted group issued could read it.
+  VTI-VOT-029 forbids exactly that: such an election is shown, and
+  confirmed to exist, only to a holder of `vtc.elections.manage`, and
+  the deleted group's identifier is never treated as a party outside
+  the community.
+
+  The member-party test is now decided by what `roll.memberOf` was when
+  the election was created; show item 1 and list item 1 say a deleted
+  group's election is seen only by a manager; show item 8.3 says a
+  presentation of the group's credential shows it to nobody. The
+  payload descriptions of show and list say the same.
+
+  Description and prose only: every schema is otherwise unchanged, as
+  CONTRIBUTING-SPECS "Version rules" allows in place for a released
+  draft version.
+
+## 0.28.14 — 2026-11-04
+
+
+### Added
+
+- **trust-task-discovery**: Publish 0.4, a responder advertises the horizon up to which it honours a stated expiresAt (#1030)
+
+SPEC §7.2 (Bounding the record) applies a consumer's maximum age only where a
+  document states no expiresAt, and since trust-tasks-rs 0.37 (#1021)
+  validate_freshness does so, honouring a stated expiry up to the policy's
+  expiry_horizon. discovery 0.3 cannot describe that: its window "governs
+  issuedAt only" and its responder refuses any document past
+  issuedAt + maxAgeSeconds + clockSkewSeconds, whatever expiresAt it states. A
+  responder that honours an expiry could only advertise a narrower window than
+  it applies, and a producer could not learn that stating an expiry keeps a long
+  delivery acceptable.
+
+  - specs/trust-task-discovery/0.4: acceptanceWindow gains an optional
+    expiryHorizonSeconds (whole seconds, at least 1), and the spec defines a
+    document's acceptance end: issuedAt + maxAgeSeconds without an expiresAt;
+    the earlier of expiresAt and issuedAt + expiryHorizonSeconds with one; and,
+    where the window carries no horizon, the earlier of expiresAt and
+    issuedAt + maxAgeSeconds, which is what a 0.3 window says.
+    - Responder: MUST NOT advertise a horizon wider than it applies, nor one at
+      all if it applies its maximum age whatever expiresAt states.
+    - Discoverer: send bounds follow the acceptance end. MAY state an expiresAt
+      within the horizon, no later than it will pursue delivery, instead of
+      issuing a chain of new attempts; a new attempt carries it unchanged.
+      Absent a horizon, it MUST assume the maximum age applies to every
+      document.
+    - AcceptanceWindow is closed in 0.3, so an added optional member is a MINOR
+      increment (§5.2): a new version, not an edit.
+    - Response-side invalid examples: a zero horizon, a duration string, and a
+      fractional entry-level horizon.
+  - trust-tasks-rs: DiscoveryRegistry::respond_to_v0_4 is the current answer.
+    acceptance_window_from reads the policy's expiry_horizon, and
+    expiry_horizon() sets one by hand. respond_to_v0_3 moves to
+    discovery/superseded.rs and states the window without the horizon (narrower
+    than applied, which 0.3 permits).
+  - trust-tasks-https: enable_discovery answers 0.4, and 0.3 beside 0.2 and 0.1.
+  - trust-tasks-dart-https: enableDiscovery answers 0.4. Dart's FreshnessPolicy
+    has no horizon, so its window states none, which says the maximum age
+    applies to every document. 0.3 moves to the superseded block.
+  - Examples and tests that named the 0.3 types use 0.4.
+  - Bindings regenerated (Rust, TS, Go, Dart). 0.3 is superseded.
+
+  Follows from #1021 and trustoverip/dtgwg-vti-spec#96 (VTI-OPS-024,
+  VTI-OPS-028, VTI-TRN-048), whose implementation in
+  OpenVTC/verifiable-trust-infrastructure states delivery deadlines as expiresAt.
+
+
+
+### Specifications
+
+- **process-attestation**: Label WritersProof as the Holder, and check that an implementation's role names a party (#1029)
+
+Follow-up to #994 and #997.
+
+  - process-attestation/0.1 lists WritersProof in the { url, role, name } form
+    #997 added, so the spec page shows which party it plays.
+  - The outcome-evidence rule says "a relying party MUST NOT", not "a consumer":
+    the rule binds whoever relies on the citing artifact, and "consumer" means a
+    document's recipient (SPEC §7.2).
+  - build-registry fails a knownImplementations role that names none of the
+    specification's parties and is not "both". The meta-schema can only bound it
+    as a string, and a typo would put an undefined party on the page.
+
+- **process-attestation**: Declare outcome evidence, bind receipts by digest, add the CPoE profile (#994)
+
+* spec(process-attestation): declare outcome evidence, bind receipts by digest, add the CPoE profile
+
+
+
+### Website
+
+- Show a task's outcome evidence and size bound, and which party an implementation plays (#997)
+
+* site: show a task's outcome evidence and size bound, and which party an implementation plays
+
 ## 0.28.13 — 2026-11-04
 
 

package/dist/_extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_extends.d.ts","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAc/D,CAAC"}
+{"version":3,"file":"_extends.d.ts","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmB/D,CAAC"}

package/dist/_extends.js

@@ -7,8 +7,13 @@
  */
 export const EXTENDS_BY_TYPE_URI = Object.freeze({
     "https://trusttasks.org/spec/rooms/keys/act/0.10": "0.9",
+    "https://trusttasks.org/spec/rooms/keys/act/0.11": "0.10",
+    "https://trusttasks.org/spec/rooms/keys/act/0.12": "0.11",
     "https://trusttasks.org/spec/rooms/keys/act/0.9": "0.8",
+    "https://trusttasks.org/spec/rooms/keys/seal/0.3": "0.2",
+    "https://trusttasks.org/spec/rooms/records/get/0.3": "0.2",
     "https://trusttasks.org/spec/rooms/records/put/0.4": "0.3",
+    "https://trusttasks.org/spec/rooms/records/put/0.5": "0.4",
     "https://trusttasks.org/spec/vta/did-templates/create/3.2": "3.1",
     "https://trusttasks.org/spec/vta/did-templates/get/3.2": "3.1",
     "https://trusttasks.org/spec/vta/did-templates/list/3.2": "3.1",

package/dist/_extends.js.map

@@ -1 +1 @@
-{"version":3,"file":"_extends.js","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,iDAAiD,EAAE,KAAK;IACxD,gDAAgD,EAAE,KAAK;IACvD,mDAAmD,EAAE,KAAK;IAC1D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,wDAAwD,EAAE,KAAK;IAC/D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,oDAAoD,EAAE,KAAK;IAC3D,oDAAoD,EAAE,KAAK;IAC3D,oDAAoD,EAAE,KAAK;IAC3D,oDAAoD,EAAE,KAAK;IAC3D,6DAA6D,EAAE,KAAK;CACrE,CAAC,CAAC"}
+{"version":3,"file":"_extends.js","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,iDAAiD,EAAE,KAAK;IACxD,iDAAiD,EAAE,MAAM;IACzD,iDAAiD,EAAE,MAAM;IACzD,gDAAgD,EAAE,KAAK;IACvD,iDAAiD,EAAE,KAAK;IACxD,mDAAmD,EAAE,KAAK;IAC1D,mDAAmD,EAAE,KAAK;IAC1D,mDAAmD,EAAE,KAAK;IAC1D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,wDAAwD,EAAE,KAAK;IAC/D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,oDAAoD,EAAE,KAAK;IAC3D,oDAAoD,EAAE,KAAK;IAC3D,oDAAoD,EAAE,KAAK;IAC3D,oDAAoD,EAAE,KAAK;IAC3D,6DAA6D,EAAE,KAAK;CACrE,CAAC,CAAC"}