14:04:45 <RRSAgent> RRSAgent has joined #vcwg
14:04:49 <RRSAgent> logging to https://www.w3.org/2026/09/09-vcwg-irc
14:04:49 <Zakim> RRSAgent, make logs Public
14:04:50 <Zakim> please title this meeting ("meeting: ..."), ivan
14:04:56 <ivan> Meeting: Verifiable Credentials Working Group Telco
14:04:56 <ivan> Agenda: https://www.w3.org/mid/69dd7d722cea187c8fca8acbae37e5d4@w3.org
14:04:56 <ivan> chair: brentz
14:04:56 <ivan> ivan has changed the topic to: Meeting Agenda 2026-09-09: https://www.w3.org/mid/69dd7d722cea187c8fca8acbae37e5d4@w3.org
14:50:26 <bigbluehat> bigbluehat has joined #vcwg
14:59:11 <pdl-ASU> pdl-ASU has joined #vcwg
14:59:16 <pdl-ASU> present+
15:00:59 <exe> exe has joined #vcwg
15:01:50 <hsano> hsano has joined #vcwg
15:02:18 <hsano> present+
15:02:33 <ivan> present+
15:03:20 <manu> present+
15:03:31 <brent> brent has joined #vcwg
15:03:39 <brent> present+
15:03:43 <KevinDean> KevinDean has joined #vcwg
15:03:46 <KevinDean> present+
15:04:03 <JoeAndrieu> JoeAndrieu has joined #vcwg
15:04:14 <JimR> JimR has joined #vcwg
15:04:17 <JennieM> JennieM has joined #vcwg
15:04:25 <dlongley> present+
15:04:39 <saad> saad has joined #vcwg
15:04:52 <ivan> present+ am, tallded, jimr, exe, wes, elaine, ingo, dmitriz, msporny
15:04:57 <michaelshea> michaelshea has joined #vcwg
15:05:03 <michaelshea> present+
15:05:41 <wes-smith> wes-smith has joined #vcwg
15:05:43 <wes-smith> scripe+
15:05:46 <wes-smith> scribe+
15:05:47 <ivan> present+ michaelshea, joe, bigbluehat, saad, kezike, jennie
15:05:58 <JennieM> present+
15:05:58 <TallTed> s/scripe+//
15:06:19 <ivan> present+ wip
15:06:35 <wes-smith> brent: Welcome to today's meeting. Is there anyone who would like to introduce themselves?
15:06:39 <kezike> kezike has joined #vcwg
15:06:47 <kezike> present+
15:07:17 <ivan> present+ eva
15:08:10 <wes-smith> ... Our agenda today - we will get updates from the task forces, discuss a proposal about publishing a suite of threat models, and do some reporting on the Global Digital Collaboration Process (?)
15:08:26 <manu> q+
15:08:45 <brent> Topic: Task Force Updates
15:08:58 <wes-smith> ... If you lead a task force please let us know how it is going. If there are issues or PRs that this group should pay attention to, please let us know.
15:09:03 <brent> ack manu
15:09:32 <manu> VCWG Task Force deliverables tracker: https://docs.google.com/spreadsheets/d/1OM-UsLnOZKywcy1eSGZsi_laCHBIy5wmQFOer0a7kYI/edit?pli=1&gid=67467047#gid=67467047
15:10:12 <wes-smith> manu: At a high level, we're doing well from a horizontal review request perspective. We have multiple requests out, for Render Method, VCALM, barcodes, and recognized entities.
15:10:26 <wes-smith> ... I have a question to the group around when we want to send out the requests for minor version specs.
15:10:44 <wes-smith> ... Also note feature freezes - not every spec that we requested horizontal review for is at feature freeze right now.
15:11:26 <wes-smith> ... For recognized entities, we are down to the last set of issues to go into candidate rec. We can put that as a feature at risk - it is trying to address a need from GS1/the supply chain traceability work.
15:11:34 <ivan> q+ michaelshea
15:11:58 <wes-smith> ... Isaac has not been able to edit that spec as much as we would prefer. Stephen Curran is a potential editor, who I believe is in the group as an IE.
15:12:21 <wes-smith> ... Recognized Entities is a couple weeks away from going into CR if we want to go that route. We have only heard back from i18n.
15:12:26 <brent> ack michaelshea
15:12:48 <wes-smith> michaelshea: Is the expectation that controlled identifiers should be going to horizontal review, or is that not appropriate given where it is?
15:12:59 <ivan> q+
15:13:14 <wes-smith> brent: the updated version of controlled identifiers should go through horizontal review, but only the diff need to be reviewed, generally.
15:13:20 <brent> ack ivan
15:13:36 <kezike> q+ for VCALM update
15:13:42 <wes-smith> ivan: In my recollection, there were no technical changes to that document so far. If there are only editorial changes we may have to notify the horizontal groups but will not have to do anything major.
15:13:52 <wes-smith> michaelshea: What is the deadline for that?
15:14:12 <wes-smith> ivan: Let's table that since it is one of many minor versions.
15:14:33 <wes-smith> ... My personal take is to postpone that until after the others have gone to CR.
15:14:54 <JoeAndrieu> q+ for confidence-method update
15:15:00 <brent> ack kezike
15:15:00 <Zakim> kezike, you wanted to discuss VCALM update
15:15:17 <kezike> https://github.com/w3c/vc-data-model/issues/1649
15:15:35 <Wip> Wip has joined #vcwg
15:15:42 <wes-smith> kezike: We are in a good place w.r.t horizontal review. Just yesterday, we added a new issue that might be good to discuss. It's relevant to the VCDM spec, where we want to add a new term in the 2.1 context to support BBS and other features.
15:15:49 <Wip> present+
15:16:00 <manu> q+
15:16:13 <wes-smith> ... Another more general thing is that there are still failures with the deployments - they are not updating when we push to prod. I want to make sure W3C folks are looking behind the scenes, as we are having to use outdated links.
15:16:22 <wes-smith> ... TR space is still not getting updated when we push to main for our specs.
15:16:26 <brent> ack JoeAndrieu
15:16:26 <Zakim> JoeAndrieu, you wanted to discuss confidence-method update
15:16:53 <JoeAndrieu> https://github.com/w3c/vc-confidence-method/pull/43
15:17:36 <wes-smith> JoeAndrieu: Two things related to this chart. The feature freeze and threat model should be half. There is some debate on a current PR that could use attention from the group. We have started a threat model - the key trick we are working through is, within confidence method we have different confidence methods and assurance levels.
15:18:24 <wes-smith> ... Our diagram either needs to address all of it or we need to have multiple diagrams. We are teasing out the best structure here. Our intention is to have the spec text and our submissions for review request in place by TPAC.
15:18:42 <brent> ack manu
15:19:07 <wes-smith> manu: To respond to kezike, I have been able to push things to TR space, so what is broken may be specific to VCALM (or a transient error). We can take it offline.
15:19:12 <wes-smith> q+
15:19:20 <kezike> scribe+
15:19:26 <brent> ack wes-smith
15:20:37 <kezike> wes-smith: VC Barcodes/ DI update: we are in a fairly good place. Review is requested for barcodes. Still ongoing work for DI, given that there are other related specs in it. Planning to put out review for VC Forgery spec. Doing update for Biststring Status List.
15:21:13 <brent> Topic: Threat Model publishing
15:21:26 <manu> q+ to propose something
15:21:30 <brent> ack manu
15:21:30 <Zakim> manu, you wanted to propose something
15:21:36 <wes-smith> brent: Next topic is threat model publishing. Is there more to it than publishing threat models as notes?
15:22:12 <wes-smith> manu: There is just a bit more. We have to decide what the short names will be as well as publication dates.
15:22:16 <pdl-ASU> pdl-ASU has joined #vcwg
15:22:22 <pdl-ASU> present+
15:22:24 <wes-smith> q+
15:22:38 <brent> ack wes-smith
15:22:44 <manu> q+
15:22:55 <brent> ack manu
15:22:55 <ivan> q+
15:22:59 <wes-smith> wes-smith: Is the threat model coupled to the version of the underlying document?
15:23:10 <wes-smith> manu: They shouldn't be versioned since they are living documents.
15:23:16 <JoeAndrieu> q+ to discuss version and multiplicity
15:24:08 <wes-smith> ivan: The note can be a living document that is still bound to a versioned document.
15:24:11 <brent> ack ivan
15:24:18 <brent> ack JoeAndrieu
15:24:18 <Zakim> JoeAndrieu, you wanted to discuss version and multiplicity
15:24:38 <manu> q+
15:25:23 <wes-smith> JoeAndrieu: +1 to the framing, but I think we should have versions on the model itself. It is not a registry which is a living document. As soon as the WG goes away we can't edit that document any more. The other thing I wanted to point out as a point of socialization is that, one thing we want to be careful of is imagining there is only one threat model for every spec. There could be multiple documents with different focuses.
15:25:53 <wes-smith> ... Those tend to want to have different documents and diagrams. We are streamlining a way to publish so that each spec has an easy way to get through the publication process. This is making it easy to get a first version out.
15:26:00 <brent> ack manu
15:26:23 <ivan> q+
15:26:28 <brent> ack ivan
15:26:39 <wes-smith> ivan: is the version in the proposal the version of the document or version of the threat model?
15:27:33 <JoeAndrieu> q+
15:27:45 <brent> ack JoeAndrieu
15:28:11 <manu> q+
15:28:19 <wes-smith> JoeAndrieu: There are two relevant versions - the underlying spec and the threat model
15:28:36 <wes-smith> +1 Joe, there are two relevant versions, don't know the best way to express that in a short name.
15:28:51 <brent> ack manu
15:29:28 <JoeAndrieu> q+ to say that general threats are fine. but the model is spec-specific
15:29:37 <wes-smith> manu: I think threat models should not be versioned, but these things are meant to live more broadly.
15:30:30 <wes-smith> ... There could be tooling issues with putting versions in the middle of a shortname.
15:30:55 <ivan> q+
15:31:17 <kezike> Even if we claim that every version of a spec should have a threat model, I don’t imagine that one spec version would have multiple threat model versions. For this reason, if we MUST add a version to the shortname of the threat model note, I think we can just borrow the same version of the spec.
15:31:18 <brent> ack JoeAndrieu
15:31:18 <Zakim> JoeAndrieu, you wanted to say that general threats are fine. but the model is spec-specific
15:31:51 <wes-smith> JoeAndrieu: You've convinced me that having it in the middle is too awkward, but I push back against the idea that threats are for a generic version of the spec. That would make them ungrounded. The value of threat modeling is that it is embodied.
15:32:16 <Ingo> Ingo has joined #vcwg
15:32:30 <brent> ack ivan
15:33:10 <manu> I would suggest that the test suite URL made the wrong decision :)
15:35:38 <JoeAndrieu> q+
15:36:15 <ivan> q+
15:36:19 <wes-smith> brent: If we update the threat model for the VC data model 2.1, do we just update the threat model?
15:36:21 <manu> q+
15:36:26 <brent> ack JoeAndrieu
15:37:10 <wes-smith> JoeAndrieu: I think we should version the threat models, I don't know that the versions need to propagate into the shortnames/URLs
15:37:11 <manu> Let's not do two versions in a URL. :)
15:37:16 <manu> Agree w/ Joe's proposal.
15:37:18 <brent> ack ivan
15:37:21 <manu> q-
15:37:35 <wes-smith> ivan: +1 to Joe, we can change the title and version number without changing the URL
15:37:49 <brent> PROPOSAL: Publish all Threat Models created by the VCWG as NOTEs. The shortnames for the threat models should start with the unversioned shortname of the associated specification, and then "-threat-model", and then "-<VERSION>" (where VERSION is the version of the associated specification). The threat models should be published at the soonest reasonable publication date as determined by Editors, Chairs, W3C Staff, and Management.
15:37:53 <manu> +1
15:37:55 <wes-smith> +1
15:37:56 <dlongley> +1
15:37:58 <JoeAndrieu> +1
15:38:00 <kezike> +1
15:38:00 <pdl-ASU> +1
15:38:01 <JennieM> +1
15:38:01 <ivan> +1
15:38:04 <TallTed> +1
15:38:09 <exe> +1
15:38:15 <ivan> q+
15:38:26 <michaelshea> +1
15:38:49 <brent> RESOLVED: Publish all Threat Models created by the VCWG as NOTEs. The shortnames for the threat models should start with the unversioned shortname of the associated specification, and then "-threat-model", and then "-<VERSION>" (where VERSION is the version of the associated specification). The threat models should be published at the soonest reasonable publication date as determined by Editors, Chairs, W3C Staff, and Management.
15:38:55 <wes-smith> brent: hearing no objections and seeing nothing but +1s, we are resolved.
15:38:56 <brent> ack ivan
15:39:18 <wes-smith> ivan: One request is to send me three URLs for three threat model documents so it's not too abstract.
15:39:28 <Antony> Antony has joined #vcwg
15:39:34 <brent> Topic: GDC Report and Q&A
15:40:37 <wes-smith> brent: Our last topic is GDC report and Q/A. Last week was Global Digital Collaboration in Geneva and attended by more than 2000 people - which is a 3x increase from last year. This is a conference that attempts to be a little bit of everything digital identity, primarily on the use case side.
15:41:35 <TallTed> s/GDC Report/Global Digital Collaboration Conference (GDC26) Report/
15:42:34 <wes-smith> ... Largely the conference was focused on mDL rollout - there were sessions that talked about ZKPs, age assurance, and identity for AI.
15:42:51 <wes-smith> ... There was also substantial discussion about trade modernization.
15:43:14 <Ingo> how was the discussion on SD-JWT vs. JSON-LD based credential formats going - if at all?
15:43:20 <manu> q+ to ask if there are any actions for us from the conference?
15:43:49 <Elaine> Elaine has joined #vcwg
15:44:20 <wes-smith> brent: There was very little conversation about data formats - most presentations just said "Digital Verifiable Credential". Most specifics were around mdoc.
15:45:08 <brent> ack manu
15:45:08 <Zakim> manu, you wanted to ask if there are any actions for us from the conference?
15:45:54 <wes-smith> manu: What we (Digital Bazaar) are experiencing is that people are moving beyond talking about  data formats/protocols - there is an expectation that everyone will support everything. That is at least our experience in North America.
15:46:35 <wes-smith> ... I'm curious what W3C said as an organizer? I know PA was there, I think I saw a picture of Dom on stage - I'm curious to hear what W3C was saying. Question 2 is whether there are any actions from the conference.
15:46:58 <wes-smith> ... Is there anything actionable happening, or is it just yet another identity conference where people talk about latest learnings but without movement on the technical side?
15:47:17 <brent> GDC 2026 Book of Proceedings: https://docs.google.com/document/d/1fPR-C59zIIARzcfLnyFrSq1SASGkocJCbbh0uKPY3bc/edit?tab=t.0
15:47:40 <Elaine> i was there - i saw simone talk about age assurance - nothing profound
15:48:00 <wes-smith> brent: I didn't attend most of the W3C centric sessions, so I wasn't in the room for a lot of that - but much of it was DC API conversations. The W3C took part in some threat modeling exercises for age assurance.
15:49:07 <TallTed> Did any attendee notice, was there any distinction drawn between W3C (D)VCs and EU D(V)Cs?
15:49:25 <wes-smith> ... As far as what this group should do, one difference that I noticed between (and this is systemic more than anything) W3C vc OIDF - the OIDF was very deliberate in the things that they supported and the sessions they proposed, whereas W3C had things that team members wanted to touch on, but for the most part sessions were left to W3C members to propose.
15:49:42 <wes-smith> ... There was less top-down-organized "here is how the W3C is going to engage with this conference".
15:50:00 <wes-smith> ... Next year it may be beneficial for at least our group to say "here is what we want to happen at this conference".
15:50:02 <michaelshea> q+
15:50:08 <brent> ack michaelshea
15:50:17 <Elaine> q+
15:50:40 <wes-smith> michaelshea: I wasn't able to attend the GDC this year, but your description sounds spot on. I was there last year. Historically it's very focused on personal identity, but what you are describing sounds very much what I would expect.
15:50:56 <brent> ack Elaine
15:51:10 <TallTed> q+ to ask whether there was any distinction drawn between W3C (D)VCs and EU D(V)Cs
15:51:26 <pdl-ASU> q+
15:51:36 <brent> ack TallTed
15:51:36 <Zakim> TallTed, you wanted to ask whether there was any distinction drawn between W3C (D)VCs and EU D(V)Cs
15:51:56 <wes-smith> TallTed: Wondering if there was a distinction drawn between W3C VCs and the EU's Digital Credentials, which have been blurred a lot over time.
15:52:13 <wes-smith> brent: For the most part they were not talking about what we are talking about.
15:52:13 <Elaine> Elaine has joined #vcwg
15:52:17 <michaelshea> unless in the trade area.
15:52:26 <wes-smith> TallTed: That is problematic, especially given that W3C was one of the organizers.
15:52:28 <Elaine> my internet went out - of course
15:52:29 <manu> I think that's by design Ted :)
15:52:31 <manu> q+
15:52:38 <michaelshea> manu +1
15:52:46 <brent> ack pdl-ASU
15:53:25 <wes-smith> pdl-ASU: the Swiss Digital ID had some pragmatic discussion previously at the conference.
15:53:25 <brent> ack manu
15:53:58 <wes-smith> manu: To reflect on what TallTed said - the coopting of the term "Verifiable Credentials" was an intentional choice. The umbrella term appears to be "Digital Verifiable Credentials", which include all the formats.
15:54:21 <wes-smith> ... There is a group that is trying to dilute what the term Verifiable Credential means.
15:54:55 <Elaine> I went to the interop Sunday and Monday before GDC at IATA - it's all mDOC - if W3C wants to be seen, there needs to be a way to participate - I don't know what that is - someone from MOSIP came to the one in Bangkok and of course, there was no "interop" for them
15:55:22 <wes-smith> ... That said, note that California talks about its digital credential program as "the mDL program" - but most of the credentials they issue are W3C VCs.
15:55:25 <Elaine> If Credence can read the CA DL then we should show up with that physical document and have it succeed
15:56:04 <dlongley> +1 an "mDL" can be (and often is) a W3C Verifiable Credential -- the terminology is quite fluid in the space.
15:56:23 <brent> q+ to voice things
15:57:10 <wes-smith> ... Item two is that I am, as a W3C member, displeased with the lack of W3C leadership around the W3C Verifiable Credential work. Leadership is not engaging with opportunities, the messaging is sloppy, and the OIDF is doing an excellent job. I am disappointed with the way W3C has engaged with GDC, and there are many lost opportunities there.
15:57:16 <brent> ack brent
15:57:16 <Zakim> brent, you wanted to voice things
15:58:35 <TallTed> problem is that the two (or more) are not interoperable
16:00:04 <michaelshea> particularly since they were a sponsor...
16:00:14 <manu> q+
16:00:40 <brent> ack manu
16:00:43 <manu> q-
16:02:04 <ivan> rrsagent, draft minutes