09:43:53 <RRSAgent> RRSAgent has joined #vcwg
09:43:57 <RRSAgent> logging to https://www.w3.org/2026/10/30-vcwg-irc
09:43:57 <Zakim> RRSAgent, make logs Public
09:43:58 <Zakim> please title this meeting ("meeting: ..."), ivan
09:44:46 <manu_> manu_ has joined #vcwg
09:45:23 <ivan> Meeting: Verifiable Credentials Working Group F2F @ TPAC 2026, Dublin, 1st day
09:45:23 <ivan> Date: 2026-10-29
09:45:23 <ivan> Agenda: https://docs.google.com/presentation/d/19vlKzO5nZjsVMVPmuI40jdSGW3kGUtAC1ngW-yQOC6g/edit?slide=id.p#slide=id.p
09:45:23 <ivan> chair: brent, phila
09:46:48 <George> George has joined #vcwg
09:47:00 <ivan> present+ dezell, brent, phila, elaine, wes, manu
09:47:04 <ivan> present+
09:47:29 <JennieM> JennieM has joined #vcwg
09:47:49 <JennieM> present+
09:48:12 <wes-smith> wes-smith has joined #vcwg
09:48:20 <brent> brent has joined #vcwg
09:48:36 <kseufer> kseufer has joined #vcwg
09:48:38 <ivan> present+ swcurran, hsano
09:49:11 <KevinDean> KevinDean has joined #vcwg
09:49:18 <KevinDean> present+
09:49:51 <kseufer> present+
09:50:00 <wes-smith> present+
09:50:04 <George> present+
09:50:22 <pdl-asu> pdl-asu has joined #vcwg
09:50:23 <markus_sabadello> markus_sabadello has joined #vcwg
09:50:29 <pdl-asu> present+
09:50:44 <ivan> present+ ingo
09:50:50 <phila> phila has joined #vcwg
09:50:54 <markus_sabadello> present+
09:51:02 <swcurran> present+
09:51:06 <ivan> present+ shigeya
09:51:20 <ivan> present+ lucy
09:51:26 <ivan> present+ bigbluehat
09:51:58 <ivan> present+ wip
09:52:09 <Yasushi> Yasushi has joined #VCWG
09:52:19 <ivan> present+ denkeni
09:52:44 <ElaineX> ElaineX has joined #vcwg
09:53:10 <Wip> Wip has joined #vcwg
09:53:14 <Wip> present+
09:53:38 <ElaineX> present+
09:53:52 <markus_sabadello> present+
09:54:18 <phila> present+
09:54:41 <ivan> present+ ivo
09:55:23 <ivan> present+ xavier
09:55:50 <dezell> dezell has joined #vcwg
09:55:58 <dezell> present+ David_Ezell
09:56:57 <wes-smith> scribe+
09:57:20 <bigbluehat> scribe+
09:57:22 <bigbluehat> present+
09:57:22 <brent> present+
09:57:22 <brent> Topic: Recognized Entities
09:57:33 <bigbluehat> manu: this is about the recognized entities task force
09:57:39 <bigbluehat> ... we'll start with a quick overview
09:57:40 <IvoL5> IvoL5 has joined #vcwg
09:57:48 <bigbluehat> ... highlight remaining issues and talk about our plan for CR
09:57:54 <bigbluehat> ... this can be interactive
09:58:08 <bigbluehat> ... so, what is this about
09:58:13 <bigbluehat> ... at some point you receive a VC
09:58:19 <bigbluehat> ... and it states who issued it
09:58:30 <bigbluehat> ... but now you need to decide if you trust the issuer
09:58:41 <bigbluehat> ... that is what Recognized Entities provides
09:58:51 <bigbluehat> ... trusting the issuer because someone else trusts it
09:59:02 <bigbluehat> ... I am going to say "trust" more often than I mean to
09:59:12 <bigbluehat> ... we try to say "recognized" instead
09:59:20 <bigbluehat> ... because it is more correct
09:59:42 <bigbluehat> ... accreditation body recognizes university, etc.
09:59:57 <bigbluehat> ... but you could also use it among family members or friends
10:00:07 <bigbluehat> ... recognizing that you share a relative, etc.
10:00:15 <ElaineX> ElaineX has joined #vcwg
10:00:19 <bigbluehat> ... so it is about recognition more that "trust"
10:00:38 <bigbluehat> ... so the RE spec tells a verifier that an issuer is recognized in a particular way
10:00:57 <bigbluehat> ... it's useful in education--recognizing graduate certificates, etc.
10:01:06 <bigbluehat> ... also use cases like vital records
10:02:08 <bigbluehat> ... and when trying to hire someone, you may need to refer to an organization to validate the issuer behind the issuance in addition to the credential itself.
10:02:13 <ivan> present+ hadley
10:02:15 <phila> q+
10:02:15 <swcurran> q+
10:02:22 <brent> ack swcurran
10:02:54 <bigbluehat> swcurran: there can be a hierarchy there...and this allows for an expression of that also
10:03:07 <bigbluehat> ... we may need a chat offline, but maybe you can clarify
10:03:21 <bigbluehat> ... does this bind the issuer identifier with other identifiers?
10:03:26 <bigbluehat> ... such as an "also known as"?
10:03:42 <bigbluehat> ... because that alone won't necessarily "bind" the identifiers
10:03:53 <bigbluehat> manu: as of 2 weeks ago, the answer is yes
10:04:05 <bigbluehat> ... this came from Steve Cappel's work
10:04:21 <bigbluehat> ... you can add an arbitrary number of registrations that an org is known as
10:04:22 <phila> s/Cappel/Capell/
10:04:28 <bigbluehat> ... also the scope
10:04:45 <bigbluehat> swcurran: excellent. That binding is crucial
10:04:46 <bigbluehat> q?
10:04:57 <brent> ack phila
10:05:09 <hsxavier> hsxavier has joined #vcwg
10:05:21 <bigbluehat> phila: hadleybeeman has joined from the TAG
10:05:23 <hsxavier> q+
10:05:34 <bigbluehat> present+ hsxavier
10:05:55 <bigbluehat> hsxavier: phila and I caught up a bit ago and I'm mainly here to see how they fit together
10:06:01 <benoit__> benoit__ has joined #vcwg
10:06:02 <brent> ack hsxavier
10:06:12 <bigbluehat> ... especially where JSONata comes in...because it feels very complicated
10:06:23 <bigbluehat> hsxavier: does this work clarify what the verifier can ask for?
10:06:25 <brent> q+ to ask is this compatible with x509?
10:06:36 <bigbluehat> manu: it can be, yes
10:06:46 <bigbluehat> ... there are concerns about over complicating that process
10:06:51 <brent> ack brent
10:06:51 <Zakim> brent, you wanted to ask is this compatible with x509?
10:06:57 <bigbluehat> ... but yes Recognized Entities could be used for that
10:07:20 <bigbluehat> brent: as a Verifier and I have some X.509 certs, can I use RE to express that?
10:07:33 <bigbluehat> manu: yes, we have some things that could get close to that
10:07:44 <bigbluehat> ... but we don't yet have anyone driving that exploration
10:07:54 <bigbluehat> ... here's an example of how it work
10:08:03 <bigbluehat> s/it work/it works
10:08:19 <bigbluehat> ... there's a list publisher
10:08:27 <bigbluehat> ... publishing a list of issuers they recognize
10:08:41 <bigbluehat> ... such as a list of universities in an accreditation body
10:08:54 <bigbluehat> ... they make the list and issue it as a VC
10:09:04 <bigbluehat> ... out of band they tell Verifiers to use that list
10:09:29 <ivan> q+
10:09:42 <bigbluehat> ... because this is a VC, the holder can deliver it as they would normally
10:09:51 <bigbluehat> ... which is intended to avoid "phone home" issues
10:10:04 <bigbluehat> ... essentially, this allows the holder to determine the delivery mechanism
10:10:05 <benoit> q+
10:10:25 <bigbluehat> ... as was mentioned earlier, you could have an international accreditation body
10:10:41 <bigbluehat> ... and that list provider could point to other local/regional lists
10:10:45 <bigbluehat> ... creating a heirarchy
10:10:57 <bigbluehat> ... that's more common in trade orgs than education orgs, currently
10:11:25 <bigbluehat> ... or, you as a human could create a list of recognized entities and distribute your social network of trusted identities
10:11:29 <brent> ack ivan
10:11:48 <bigbluehat> ivan: the fact that you used DID is because it's nice? or because it is required?
10:11:57 <bigbluehat> manu: you can use whatever identifier you want
10:12:07 <bigbluehat> ... but there are some algorithms out there that require them
10:12:12 <bigbluehat> ivan: not this one?
10:12:22 <bigbluehat> manu: this one includes a lot of hand waving
10:12:23 <bigbluehat> q?
10:12:36 <bigbluehat> ... there are situations where the Issuer states what list they're in
10:12:47 <bigbluehat> ... vs. the reverse where the Issuer is pointed at from the list
10:13:02 <bigbluehat> ivan: it's a fairly important point
10:13:26 <lola> lola has joined #vcwg
10:13:26 <bigbluehat> .... not to be derogatory, but we're adding a DID here because it looks good
10:13:35 <lola> present+
10:13:39 <bigbluehat> ... but we need to make sure we call out where it shows up as a requirement
10:13:45 <bigbluehat> manu: let me put it this way
10:14:01 <bigbluehat> ... I'm trying to work through all the specs in my head...to confirm where this applies
10:14:15 <bigbluehat> ... all the use cases we have, GS1, UN, etc. all use DIDs
10:14:16 <phila> q+
10:14:29 <bigbluehat> ... we don't currently have anyone saying they want to use a CID or HTTP identifier
10:14:38 <brent> ack benoit
10:14:39 <bigbluehat> ... it should be possible, but we don't have anyone doing that yet
10:14:50 <bigbluehat> benoit: I understand the publishing of the list
10:14:52 <denkeni> q+
10:15:18 <bigbluehat> ... you have a Uni that's on the list, but later falls a fowl of the group and gets removed from the list
10:15:33 <bigbluehat> ... how do those VCs issued while they were trusted remain valid/useful?
10:15:47 <bigbluehat> manu: it's possible to put date ranges on the entries
10:16:04 <KevinDean> q+
10:16:04 <bigbluehat> benoit: you're trusting the list provider to not delist them entirely?
10:16:52 <bigbluehat> manu: yes, essentially, a watchdog group or other can also publish their own list that runs in parallel that augments the "authoritative-ness" of the "core"/original list
10:17:10 <brent> ack phila
10:17:17 <bigbluehat> ... we've been trying to avoid the word "trust" because trust is a relative concept
10:18:00 <bigbluehat> phila: if you're going to issue a list, then you sign yourself up for a large scale claim of authority
10:18:04 <wes-smith> q+
10:18:06 <brent> ack denkeni
10:18:14 <bigbluehat> ... and you'd likely have to revoke the whole list...
10:18:31 <bigbluehat> ... we instead are planning to use smaller lists or even single VCs
10:18:54 <bigbluehat> denkeni: we plan to use RE's for cross boarder use
10:19:12 <bigbluehat> ... Taiwan and Korea are issuing Driver's Licenses as W3C Verifiable Credentials
10:19:27 <brent> ack KevinDean
10:19:32 <bigbluehat> ... and we're using Recognized Entities to provide the lists of valid issuers across those boarders
10:19:41 <manu_> q?
10:20:00 <bigbluehat> KevinDean: each VC has a validity period
10:20:15 <bigbluehat> ... and it's going to be hard to state a date range of "recognition"
10:20:26 <bigbluehat> ... often those get reviewed on a time scale--every 5 years
10:20:42 <bigbluehat> ... so it's not only revocation, it also may require "re-recognition"
10:21:08 <bigbluehat> ... as long as my recognition happened within the list's own validity period
10:21:37 <bigbluehat> ... my degree may still be valid because it happened while the university was on the list, but before the required expiration
10:21:45 <dezell> dezell has joined #vcwg
10:21:46 <brent> ack wes-smith
10:21:56 <bigbluehat> ... many of these questions effect VCs as a whole
10:22:19 <bigbluehat> wes-smith: lost of these use cases can encourage more involvement
10:22:27 <brent> q+
10:22:29 <bigbluehat> ... does Entity A recognize Entity B?
10:22:35 <denkeni> s/boarders/borders
10:22:59 <bigbluehat> ... there's also the question of "do I care?" that A recognizes B
10:23:01 <brent> ack brent
10:23:03 <KevinDean> q+
10:23:15 <bigbluehat> ... but that is perhaps out of the bound for the tech
10:23:23 <bigbluehat> brent: let's talk to the TAG
10:23:36 <bigbluehat> manu: agreed. quick summary of who we've been working with on RE's
10:23:44 <bigbluehat> ... (shows list on slide deck)
10:24:02 <bigbluehat> ... we have been talking to a lot of people about how they publish trust lists
10:24:12 <bigbluehat> ...  we have asked for horizontal reviews
10:24:14 <KevinDean> q-
10:24:26 <bigbluehat> ... internationalization is almost done, security is done
10:24:36 <bigbluehat> ... still waiting on a11y...so we're in "ok" shape
10:24:44 <bigbluehat> ... here are some issue and PR stats
10:24:53 <bigbluehat> ... we wanted to be in CR now, but we are indeed very close
10:24:57 <bigbluehat> ... k. TAG time
10:24:59 <bigbluehat> ... JSONata
10:25:26 <bigbluehat> ... first is around the technology itself
10:25:45 <bigbluehat> ... the RE specification as it stands today, is similar to a certificate authority list
10:25:59 <bigbluehat> ... certain entities within the list are recognized to do certain things
10:26:45 <bigbluehat> ... so, when someone receives a credential, they need to confirm both that the Issuer had the correct authorization (per the list) to issue the credential
10:27:03 <bigbluehat> ... I can check the list, walk the chain, up to the list provider that I recognize
10:27:15 <bigbluehat> ... currently, we're using JSONata to do that tree walking and checking
10:27:24 <bigbluehat> ... we tried a few simpler things
10:27:37 <bigbluehat> ... comparing identifiers--did low level match mid level, etc.
10:27:46 <bigbluehat> ... but the more complex the chain got the harder that got
10:27:57 <bigbluehat> ... we tried JSON Schema, but that lacks multi-level checking
10:28:23 <bigbluehat> ... so you ended up with a massive schema attempting to check an impossibly large object to check the combined lists
10:28:29 <bigbluehat> ... and one had to generate that
10:28:39 <bigbluehat> ... so, JSONata simplifies that greatly
10:28:46 <bigbluehat> ... however, it's written by 2 people
10:28:54 <bigbluehat> ... it does have stable versioned documentation
10:29:09 <bigbluehat> ... so there are open questions around it
10:29:25 <bigbluehat> ... is it going to be enough? op do we need a Turing complete language--Python, etc.
10:29:38 <brent> q+
10:29:47 <bigbluehat> ... and does the spec itself need to provide that? or does it happen at the application layer only?
10:29:58 <brent> q-
10:29:59 <bigbluehat> ... right now it _seems_ like JSONata does that
10:29:59 <bigbluehat> Subtopic: JSONata
10:30:22 <bigbluehat> hadleybeeman: quick intro, lola and Heather are here with me from the TAG
10:30:36 <bigbluehat> ... we have been reviewing it...sorry it's been mostly invisible, but here we are
10:30:49 <bigbluehat> ... we do have concerns about JSONata
10:31:08 <bigbluehat> ... I do hear you on the limitations of JSON Schema--it's clear that's insufficient for this use case
10:31:17 <lola> q+
10:31:23 <wes-smith> q+
10:31:38 <bigbluehat> ... we do have many concerns about the JSONata community's stability, etc.
10:31:41 <brent> q+ to ask about punting
10:31:53 <brent> q-
10:31:56 <bigbluehat> ... it may be good to look at using the RDF and JSON-LD capabilities you have on hand to do the same checking
10:32:11 <bigbluehat> ... I realize that's a different kind of complicated, but it is available to you
10:32:12 <brent> ack lola
10:32:21 <bigbluehat> ... and I do wonder about "why not" Python, etc.
10:32:38 <phila> q+ to talk about tools for traversal
10:32:39 <bigbluehat> lola: so, why not let the implementers decide how the tree is walked, etc.?
10:32:49 <bigbluehat> ... why does it have to happen within this specification?
10:33:06 <bigbluehat> manu: we've had a few participants ask to put it into the spec
10:33:10 <bigbluehat> ... so that there's interop
10:33:15 <wes-smith> q-
10:33:35 <bigbluehat> ... because otherwise it's unspecified and they may do it "however" and we won't know how that is done
10:33:46 <bigbluehat> phila: GS1 hat on
10:33:48 <ivan> q+
10:33:55 <ivan> ack phila
10:33:55 <Zakim> phila, you wanted to talk about tools for traversal
10:34:07 <bigbluehat> ... my aim is that an industrial scanner, like a border control person would use
10:34:14 <bigbluehat> ... not a point of sale one, but a border crossing one
10:34:23 <bigbluehat> ... that VC is likely in a barcode
10:34:34 <bigbluehat> ... and I want that scanner to be able to do the full verification
10:34:45 <bigbluehat> ... so I need that scanner equipment to do the whole stack
10:34:46 <wes-smith> q+
10:34:58 <bigbluehat> ... I need to ask them to put in certain code in their scanner
10:35:15 <bigbluehat> ... vs. asking them to sort out what the thing is and how to figure it out themselves
10:35:32 <bigbluehat> Heather: first, I want to share a bit more of our questions
10:35:54 <bigbluehat> ... second, I do want to giggle at the fact that JSONata calls itself "lightweight"
10:36:06 <bigbluehat> ... maybe explore JQ Lang
10:36:31 <bigbluehat> manu: mainly, the implementers already implemented JSONata
10:36:41 <bigbluehat> ... I don't think they looked at JQ Lang
10:36:49 <brent> q+ to ask about punting and GS1 just writing the code
10:36:55 <brent> ack ivan
10:37:06 <bigbluehat> Heather: yeah, if there's a way to avoid forking something that seems un maintained, that would be good
10:37:28 <bigbluehat> ivan: we do have other specs that depend on JSONata
10:37:33 <bigbluehat> ... VCALM depends on it now
10:37:49 <bigbluehat> ... and I commented it earlier that it is not specifiable
10:37:59 <bigbluehat> manu: they're already shipping it in production, so...
10:38:11 <bigbluehat> ivan: sure, but we're not sure we can specify it into the specs
10:38:28 <bigbluehat> manu: sure, we did start with JSON Schema, but it fell over pretty quickly for this use case
10:38:37 <bumblefudge> bumblefudge has joined #vcwg
10:38:45 <phila> The metrology use case is complicated. See https://github.com/w3c/vc-recognized-entities/issues/139 (too much to read through during the meeting but you'll get a sense that this ain't simple.
10:38:46 <bumblefudge> q+
10:38:52 <bigbluehat> ... and JSONata was far simpler--and avoided running arbitrary JavaScrpit on the chain
10:38:56 <lola> q+
10:39:01 <bigbluehat> ... but that may still be where we end up ultimately
10:39:04 <hadleybeeman> q+
10:39:13 <bigbluehat> ... that's the backstory
10:39:24 <bigbluehat> ... we are using JSONata in VCALM to build matching templates
10:39:24 <ivan> present+ lola
10:39:32 <bigbluehat> ... in the VC API/VCALM work
10:39:38 <bigbluehat> ... that one is much less likely to change
10:39:50 <ivan> present+ bumblefudge
10:40:07 <brent> ack wes-smith
10:40:09 <bigbluehat> ... that's a different application, but similar need
10:40:36 <bigbluehat> ... we are not using it in Render Method--that's a typo on the slides
10:40:56 <brent> ack brent
10:40:56 <Zakim> brent, you wanted to ask about punting and GS1 just writing the code
10:40:58 <bigbluehat> wes-smith: I wonder if there's a way to point at JSONata as an option for folks profiling these specs
10:41:07 <bigbluehat> ... so they could use it if they want
10:41:16 <bigbluehat> brent: could the spec just say "what MUST happen"
10:41:24 <bigbluehat> ... and perhaps point to JSONata as an option for doing it
10:41:35 <bigbluehat> ... does this specification need to require JSONata?
10:41:45 <bigbluehat> ... or just state that "implementers MUST do these things"
10:41:59 <bigbluehat> ... even if JSONata need to be specified as a normative dependency?
10:42:01 <phila> q+ to respond to Brent
10:42:29 <bigbluehat> manu: i get what you're saying, make the behavior the normative statement
10:42:36 <bigbluehat> ... we had the same dance with JSON Schema
10:42:46 <bigbluehat> ... it failed to get through the IETF multiple times
10:43:01 <bigbluehat> ... but we're in a similar state
10:43:12 <bigbluehat> ... JSONata is being used in multiple places
10:43:23 <bigbluehat> ... but it feels like W3C process is getting in the way...
10:43:28 <brent> ack bumblefudge
10:43:58 <bigbluehat> ... all the implementers we know of are using it, because we can't say that because of process
10:44:09 <bigbluehat> bumblefudge: so, maybe test suites drive the choice?
10:44:11 <benoit> q+
10:44:20 <IvoL> IvoL has joined #vcwg
10:44:37 <wes-smith> wes-smith has joined #vcwg
10:44:38 <bigbluehat> ... as in, do the conformance requirements drive the fact that JSONata is the obvious choice?
10:44:45 <phila> q+ to respond to Brent and Wes
10:44:56 <bigbluehat> manu: there has to be a constraints language
10:45:10 <bigbluehat> ... ideally expressed in the list, so it is also verifiable
10:45:21 <bigbluehat> ... it could be JSON Schema produced via JSONata
10:45:23 <brent> ack lola
10:45:27 <bigbluehat> ... or raw JavaScript
10:45:34 <bigbluehat> ... but it has to be in there
10:45:52 <bigbluehat> lola: you mentioned a question around JavaScript as an option. What is preventing you from using that?
10:46:03 <bigbluehat> manu: people are concerned about keeping it safely runnable
10:46:21 <bigbluehat> ... because it could be possible to introduce new attack vectors
10:46:33 <phila> q+ heather
10:46:39 <bigbluehat> ... and the fear of DOS attacks and similar arriving in the package
10:46:45 <bigbluehat> hadleybeeman: 2 questions
10:46:47 <brent> ack hadleybeeman
10:47:03 <ivan> present+ heatherf
10:47:06 <bigbluehat> ... why do you have to validate the entire chain at once?
10:47:29 <bigbluehat> manu: there are parts in the chain that point to each other
10:47:54 <bigbluehat> ... in the GS1 use case, the G10 points to a prefix in the chain above it
10:48:03 <bigbluehat> ... and you have to keep walking up the tree
10:48:17 <bigbluehat> hadleybeeman: yeah...at that point, you want some sort of touring complete language
10:48:40 <brent> ack phila
10:48:40 <Zakim> phila, you wanted to respond to Brent and to respond to Brent and Wes
10:49:21 <bigbluehat> phila: from our direct experience, we'd rather provide software than the 600+ page PDFs to the teams we work with
10:49:29 <bigbluehat> ... some of these companies just use our OSS
10:49:42 <bigbluehat> ... other's say "nice, thanks, I'll write my own based on this code"
10:49:54 <bigbluehat> ... someone proposed a non-normative note
10:50:03 <bigbluehat> ... the implementers generally could care less
10:50:05 <brent> ack benoit
10:50:19 <bigbluehat> ... I don't want GS1 to have to write that Note
10:50:35 <bigbluehat> benoit: why does JSONata be specified exactly?
10:50:48 <bigbluehat> ... I may just ignore it and do my own code anyway
10:51:05 <ivan> q+
10:51:19 <bigbluehat> ... so maybe back to the MUSTs around how the list is validated/checked more options if we leave it out
10:51:26 <brent> ack heather
10:51:33 <hadleybeeman> q+
10:51:44 <bigbluehat> heather: heard on the reasons why you wouldn't want to use JavaScript
10:52:08 <bigbluehat> ... but you're also setting up a future where you're rebuilding somethin that's headed toward that complexity...
10:52:15 <brent> ack ivan
10:52:23 <bigbluehat> ... frequently something like this can trend that way
10:52:38 <bigbluehat> ivan: circling back to "what's the problem"
10:53:01 <bigbluehat> ... if we do this in JSONata, we may have a whole world of people who have no idea what it is...a bit like now
10:53:22 <bigbluehat> ... the reason W3C requires these things is so that we can prove to the world, long term, that the things we point to are stable and understandable
10:53:27 <bigbluehat> ... we don't have that with JSONata
10:53:36 <bigbluehat> ... it's an individual project by a smart guy
10:53:42 <bigbluehat> ... but there's not much more than that
10:53:57 <bigbluehat> ... I have already had the experience of disappearing software
10:54:03 <brent> ack hadleybeeman
10:54:07 <bigbluehat> ... the latest for me is deno
10:54:19 <bigbluehat> hadleybeeman: big +1 to bot Heather and ivan
10:54:30 <bigbluehat> ... my concerns are 10+ years from now
10:54:38 <bigbluehat> ... what happens when there's no WG
10:54:39 <brent> q+
10:54:55 <bigbluehat> ... perhaps JSONata disappears or has major issues, and there's no group around to respecify
10:55:09 <bigbluehat> ... but using something already specifiable would be better
10:55:15 <bigbluehat> ... because it's more stable long term
10:55:32 <bigbluehat> ... if JSONata ends up still being in the spec, please leave loads of notes for the future
10:55:38 <brent> ack brent
10:55:44 <bigbluehat> ... because it's own future is already a concern
10:56:22 <bigbluehat> brent: so, TAG is recommending a known language?
10:57:14 <bigbluehat> manu: I don't think JavaScript will work for implementers
10:57:20 <bigbluehat> hadleybeeman: you can ignore TAG advice
10:57:29 <bigbluehat> manu: I think it's good input
10:57:38 <bigbluehat> ... no one is requiring JSONata
10:57:45 <bigbluehat> ... this has been good input
10:57:58 <bigbluehat> ... maybe if we talk about going to CR that will clarify things?
10:58:08 <bigbluehat> ... we think we are largely feature complete
10:58:24 <bigbluehat> ... we've shown that we can do all the use cases we know of
10:58:42 <bigbluehat> ... so, we could mark the JSONata stuff as "at risk"
10:59:03 <bigbluehat> ... and mention that a Turing complete language might be a replacement
10:59:11 <bigbluehat> ... how does the group feel about that approach?
10:59:35 <bigbluehat> ... k. I think we'll just try that and then check in on the language again
10:59:58 <bigbluehat> hadleybeeman: we'll try to get you a response in the next two weeks
11:00:16 <bigbluehat> brent: thanks all! break time. back in 30 minutes
11:02:00 <phila> RRSAgent, make logs public
11:02:07 <phila> RRSAgent, draft minutes
11:02:08 <RRSAgent> I have made the request to generate https://www.w3.org/2026/10/30-vcwg-minutes.html phila
11:18:05 <benoit> benoit has joined #vcwg
11:23:21 <phila> phila has joined #vcwg
11:25:08 <kseufer> kseufer has joined #vcwg
11:30:46 <IvoL> scribe+
11:31:08 <ElaineX> Topic: DPP and Business Wallets
11:32:07 <IvoL> brent: summary of the morning and moving to digital product passports and business wallets.
11:33:21 <IvoL> Ingo: introduction of recognized entities with CE marking
11:33:44 <dmitriz> dmitriz has joined #vcwg
11:33:50 <IvoL> ... explanation about who the group contains, Carolynn, Carsten are Facilitators
11:34:20 <IvoL> ... This is the Verifiable Credentials working group Task Force vc-dbw
11:34:38 <IvoL> ... Business wallets are a different style of wallets, for businesses
11:34:41 <phila> phila: For those not familiar, Ingo is talking about the CE marking use case: https://europa.eu/youreurope/business/product-rules-compliance/general-product-compliance/ce-marking/index_en.htm
11:34:59 <brent> q?
11:35:10 <IvoL> .... The motivation is that there are no common vocabulary for product and organisational credentials. And to many overlapping standards and registries
11:35:12 <Jem_> Jem_ has joined #vcwg
11:35:13 <pdl-asu8> pdl-asu8 has joined #vcwg
11:35:36 <IvoL> ... the goal: data fusion. One product or one legal entity described by several standards
11:35:58 <TallTed> present+
11:35:58 <IvoL> .... Guidance on mapping the EU DPP data model
11:36:37 <RRSAgent> I have made the request to generate https://www.w3.org/2026/10/30-vcwg-minutes.html TallTed
11:36:41 <phila> q+ to ask about doc statuses
11:36:41 <IvoL> ... the deliverables: vocabulary for: DPP and Business wallets, use cases and requirements ....
11:37:01 <IvoL> .... explains about the use cases, for example the batteries
11:37:51 <IvoL> ... The DPP is as trustworthy as the issuer, but the manufacturer identy can come from a Business Wallet credential
11:37:56 <brent> q+ to ask why notes
11:38:29 <IvoL> ... The example sits where three VCWG work items meet, DPP vocabulary, Business Wallet vocabularies and Recognized Entities
11:38:51 <IvoL> ... problem: Who vouches for a CE mark?
11:39:16 <IvoL> ... example, a CAB is recognized twice, so a verifier may need both chains
11:39:51 <IvoL> ... the issuer POV is displayed on the slide
11:40:22 <IvoL> ... the circle represents the issuer of the credential in the current slide: Isuance: credentials along the chain
11:40:59 <IvoL> ... the conformity assesment body needs to be accredited, on a national level
11:41:22 <IvoL> ... there is a bigger hierachy, there is also a european level but also a global level
11:41:45 <IvoL> ... on the bottom there is a third chain, the manufacturer of the battery.
11:42:09 <IvoL> ... The manufacturer is registered as business, that is also verified
11:42:36 <IvoL> ... current example: where register recognizes manufacturer
11:42:56 <IvoL> ... the logistical register handles it for germany for example
11:43:33 <IvoL> ... example: accreditation of the CAB, the CAB is also recognized,
11:44:00 <IvoL> ... the action is also recognized to issue the CE mark
11:44:19 <IvoL> ... we still have a discussion where to place it in the JSON
11:44:33 <IvoL> ... the 2 chains meet at the CAB right now in this example
11:44:55 <IvoL> ... the DID can be a subject, the notification but also the accreditation
11:45:13 <IvoL> ... recognizedBy shows the recognition, not the next in line for credential
11:45:33 <IvoL> ... ScopedRecognizedAction says what it can certify
11:45:50 <IvoL> ... offline verification diagram
11:46:00 <IvoL> ... this is the use case we have in scope
11:47:02 <IvoL> ... They scan the DPP wich will go to trough the chain to manufacturer, the CAB, wich is recognised by the local CAB, the european CAB
11:47:50 <IvoL> ... There are also needs for who recognises the CAB
11:48:29 <IvoL> ... takeaways: one entitiy but with several roots we want to verify in the recognision chain
11:48:54 <IvoL> ... stapled chain that can be verified offline but both brnaches must be vlaidated
11:49:17 <IvoL> ... We want to have the information in the credential
11:49:35 <IvoL> brent: There is a queue
11:49:48 <IvoL> Ingo: references are on the slide
11:49:51 <brent> ack phila
11:49:51 <Zakim> phila, you wanted to ask about doc statuses
11:50:28 <IvoL> phila: Brent will talk about document statusses. you have presented string of characters, not automated chain of authority. Do you want it automated?
11:50:56 <IvoL> Ingo: The examples we currently have is a PR, that will make it more clear.
11:50:59 <denkeni> q+ on vocabulary governance and business register
11:51:11 <manu_> q+ to ask about how much could we change in the next six months wrt. how the system you presented could work?
11:52:38 <brent> ack brent
11:52:38 <Zakim> brent, you wanted to ask why notes
11:52:39 <IvoL> Brent: Slide 13, like what i see, 3: there is a normative statement but why is everything a note insted of recomendation
11:53:13 <IvoL> ivan: we did not discuss this so far yet we started out as notes but we have not decided yet. It is a description
11:53:20 <phila> q+ to talk about publication timelines
11:53:43 <IvoL> ... For that application specifically you need all 3. But it is not part of a recommendation.
11:53:54 <IvoL> ... We are not decided yet
11:54:56 <IvoL> ... The DPP has many different DPP's in the world, we are not sure where we would go. But for the time beeing we are still discovering
11:55:06 <brent> ack denkeni
11:55:06 <Zakim> denkeni, you wanted to comment on vocabulary governance and business register
11:55:33 <IvoL> denkeni: We also working on DPP and we also look at Business identity
11:56:20 <IvoL> ... The dpp started with battery, but there a many other industries
11:57:13 <IvoL> Ingo: We have github and a lot of vocabularies are mentioned, and Carolynn is in a research with many industries where she can advice
11:57:47 <IvoL> denkeni:  are there other organisations that will pick up?
11:58:13 <brent> ack manu_
11:58:13 <Zakim> manu_, you wanted to ask about how much could we change in the next six months wrt. how the system you presented could work?
11:58:32 <IvoL> ... the ministry of economics issueing the did for web for the companies right?
11:58:35 <IvoL> Ingo: Correct
11:59:00 <ivan> q+
11:59:24 <IvoL> manu_: There is lots of flexibility, think the expectation that the vocabulary development will be elsewhere but our job is to stay in communication with those organisations,
11:59:28 <IvoL> Ingo: Correct
11:59:31 <brent> ack phila
11:59:31 <Zakim> phila, you wanted to talk about publication timelines
12:00:07 <IvoL> phila: everything is on Github but not on the working draft, advice: put it in a working draft.
12:01:01 <IvoL> ... acknowledge that the group does not have a lot of W3C experience and that he could not be at every meeting
12:01:11 <IvoL> ... but we should start with the W3C process
12:01:29 <brent> ack ivan
12:02:04 <IvoL> ivan: we hit the Action property, but our problem was, we need a richer set of terms there.
12:02:20 <IvoL> ... that's the reason we came up with the ScopeRecognizedAction
12:02:54 <manu_> q+
12:03:17 <ElaineX> ElaineX has joined #vcwg
12:03:27 <IvoL> ... this is not the only application area where it will come up
12:03:59 <IvoL> ... my feeling is: this taskforce will not produce recommendations, because we don't want to produce M+1 standards
12:04:26 <IvoL> ... This is an example we will put as a PR at the recognizedEntities
12:04:59 <IvoL> ... These examples are more then just for recognizedEntities, it is an example for VC as an whole as an example
12:05:20 <IvoL> ... The example should be published as a separate note
12:05:20 <manu_> q+ to note that action is a string
12:05:48 <brent> ack manu_
12:06:05 <IvoL> manu_: "action" is just a text string
12:06:31 <IvoL> ... my hope is that let us know if we can fix it if it is an issue for you
12:07:04 <IvoL> ... This is another example that might not easily fit into the JSON schema
12:07:38 <IvoL> ... Maybe it should be a multifield or something equivalent
12:07:44 <swcurran> q+
12:08:03 <IvoL> brent: how can we be most productive help this group?
12:08:04 <brent> ack swcurran
12:08:31 <benoit__> benoit__ has joined #vcwg
12:09:16 <IvoL> swcurran: in the Did web EH we work on recognizedEntity, one of the this we talked is the verified history mechanism.
12:09:39 <IvoL> ... is this the place for that?
12:09:42 <manu_> q+ to ask what help would be useful from us? Playground examples? UNTP alignment?
12:09:48 <brent> ack manu_
12:09:48 <Zakim> manu_, you wanted to ask what help would be useful from us? Playground examples? UNTP alignment?
12:10:32 <IvoL> manu_: how can we help? we have a recognizedEntitiy example, but it would be nice to have the example in the VC playground.
12:11:04 <IvoL> ... can we get some examples from the Business Wallets group? and is there alignment with the UNTP and can we help there?
12:11:39 <IvoL> ... what can we do to help?
12:11:53 <IvoL> Ingo: we can work out the example
12:12:09 <IvoL> ... it would help promoting it and accessible for other parties
12:12:31 <manu_> q+
12:13:01 <IvoL> manu_: half of the specs is examples now. But concerned about moving the examples (or all) out of the spec)
12:13:30 <IvoL> ... because people might lose the visualisation how to implement it.
12:13:37 <IvoL> ivan: We have diagrams for all of them
12:13:38 <IvoL> manu_
12:13:43 <brent> ack manu_
12:14:13 <IvoL> manu_: we can do that at the end of CR, look at the examples. and right before REC we split the examples from the doc
12:14:52 <IvoL> brent: some of what described in the flow is using recognizedEntities, are there other things that needs to be defined?
12:15:13 <manu_> q+ to ask about concrete production deployments using this?
12:15:20 <brent> ack manu_
12:15:20 <Zakim> manu_, you wanted to ask about concrete production deployments using this?
12:15:32 <IvoL> ... do we need additional specification on other credential types?
12:15:46 <IvoL> manu_: what are we trying to hit? And use that as a focus
12:16:27 <IvoL> ... I am concerned that we don't have the same timeline
12:16:44 <IvoL> ... we would like to see how the conformity certificate will look like concrete
12:17:08 <IvoL> ... recognizedEntity chain and see it deployed for example in Germany
12:17:35 <phila> q+ to talk about GS1's timeline
12:17:57 <IvoL> Ingo: timeline wise the European business wallet is beeing finished in 2028 and  timeline wise it fits very well
12:17:59 <brent> ack phila
12:17:59 <Zakim> phila, you wanted to talk about GS1's timeline
12:18:30 <IvoL> phila: GS1 hat: We have a big event in Februari 2027 and hoping we can say: Here are GS1 credentials!
12:18:53 <IvoL> ... acknowledges the timeframe
12:19:15 <IvoL> brent: We can move forward with the agenda
12:19:21 <wes-smith> wes-smith has joined #vcwg
12:19:27 <IvoL> ... Next up are the chairs
12:19:27 <phila> Topic: Future Plans
12:20:20 <IvoL> phila: Was hoping we have documents beeing finished
12:20:56 <IvoL> phila: consious that TPAC next year is probably in december because of weather. we can't wait for the next TPAC meeting
12:21:21 <IvoL> ... proposal: April, a VC meeting F2F and does anyone want to create a F2F meeting?
12:21:41 <IvoL> ... We think this is helpfull for this group.
12:22:21 <manu_> q+
12:22:25 <IvoL> brent: if it goes well and the F2F is fruitfull it is not concrete that we don't need another meeting F2F before december 2027
12:22:47 <IvoL> ... We need at least a meeting room, not much else
12:23:15 <shigeya> q+
12:23:25 <IvoL> ... Ubico has to small of a meeting room
12:23:57 <TallTed> Lucy asks (in zoom): By when do you need to know? (Sorry having to type here as my flight is about to take off)
12:24:25 <brent> ack manu_
12:24:48 <IvoL> shigeya: want to host but for university is impossible in april or may
12:25:00 <IvoL> brent: What time might work?
12:25:09 <IvoL> shigeya: June, not March
12:25:16 <brent> ack shigeya
12:25:40 <brent> q+
12:25:52 <IvoL> manu_: Digital Bazaar is happy to cover food, etc. But we need to look at work spaces. But also Lucy is looking at Montreal for a place
12:26:11 <denkeni> q+ MODA could offer a meeting room
12:26:14 <phila> q+
12:26:27 <IvoL> manu_: +1 for April but maybe later in the year
12:26:29 <denkeni> q+
12:26:32 <brent> ack brent
12:26:53 <IvoL> brent: possibility: got connections with the W3C folks in China, we can get a space maybe there
12:26:55 <brent> ack phila
12:27:19 <IvoL> phila: maybe to fast to reject Sao Paulo, but maybe we should think about it.
12:27:47 <brent> ack denkeni
12:28:09 <IvoL> denkeni: I also have a meeting room but i have to check,
12:28:49 <IvoL> ... It is in Taipei
12:29:23 <IvoL> brent: In Halifax there is also a AC meeting in April, so maybe combine? But looking at options
12:29:31 <IvoL> ... do we have a preference?
12:30:24 <IvoL> ivan: if we take Panama and Sao Paulo, then for europeans, it is impossible because of distance and price, preference in europe.
12:30:51 <IvoL> phila: We spoke to Carolynn, she has the space but traveling is a burden. 2 hour train at the airport
12:31:37 <IvoL> ... understands but Montreal is also far. But maybe not that far
12:32:40 <manu_> q+ to note that we do need to move with a bit more urgency with some specs
12:32:43 <IvoL> phila: Aware of the work that happened and still needs to happen. We have to be at CR preferabel in April
12:33:22 <brent> ack manu_
12:33:23 <Zakim> manu_, you wanted to note that we do need to move with a bit more urgency with some specs
12:34:06 <IvoL> manu_: We are doing fine from a charter perspective but we need to move with a bit more urgency perspective
12:34:10 <ivan> present+ george
12:35:18 <IvoL> ... We are ok with recognizedEntities, renderMethod should have more velocity, dataIntegritySpecs, should also have more velocity but thanks to the people that picks it up
12:35:37 <IvoL> ... if you are an editor you should have a hard look at the issues
12:36:00 <IvoL> ... If we are not in CR with all the specs next year F2F, we should question about this
12:36:24 <IvoL> ... The horizontal review is not a simple thing to deal with. it will need a couple of months to respond
12:36:49 <George> present +
12:37:10 <IvoL> ... raising that as a warning and we should raise the velocity
12:37:31 <George> To the Utah convo - I can say there are always possibilities...
12:37:37 <IvoL> brent: Is there a structure for the main hall that could accelerate things
12:38:02 <manu_> q+ to maybe ask them what is the date for CR? how many before-CR issues do you have left?
12:38:17 <IvoL> ... Let us know what we can do to help
12:38:17 <brent> ack manu_
12:38:17 <Zakim> manu_, you wanted to maybe ask them what is the date for CR? how many before-CR issues do you have left?
12:38:31 <phila> q+ to note George's comment
12:38:40 <IvoL> manu_: Ask more pointed questions to the leaders of the group, for example: What is the date for this CR?
12:38:56 <ivan> q+
12:38:59 <IvoL> ... Just ask: How many CR issues do you have and what is the closing rate? For example
12:39:06 <brent> q+ to ask about project management
12:39:17 <brent> ack phila
12:39:19 <Zakim> phila, you wanted to note George's comment
12:39:27 <IvoL> phila: note: George made some comments
12:39:44 <brent> ack ivan
12:39:48 <IvoL> ... Some groups need more support
12:40:01 <dezell> dezell has joined #vcwg
12:40:11 <IvoL> ivan: What we do not get on the course: We dont hear about fundamental issues taskforces have met.
12:40:25 <phila> q+
12:40:32 <swcurran> Manu -- turn your presentation data into a progress dashboard?
12:40:45 <IvoL> ... for example: JSONata, has never been mentioned in the general VC meeting
12:41:18 <brent> ack brent
12:41:18 <Zakim> brent, you wanted to ask about project management
12:41:18 <IvoL> ... There are other examples also in other taskforces
12:41:30 <IvoL> brent: Would it help to do more project management?
12:41:50 <manu_> q+
12:41:58 <bigbluehat> q+
12:42:07 <phila> q-
12:42:08 <IvoL> ... the progress tracker is maybe not detailed enough
12:42:25 <bigbluehat> q+ to propose "managing by walking around" via cross-task force participations
12:42:30 <brent> ack manu_
12:42:46 <IvoL> manu_: +1 to that but lets not make it a progress management hellscape
12:43:09 <phila> q+
12:43:10 <IvoL> ... maybe update the status tracker to see the PR's
12:43:31 <brent> ack bigbluehat
12:43:31 <Zakim> bigbluehat, you wanted to propose "managing by walking around" via cross-task force participations
12:43:51 <IvoL> bigbluehat: would it help if people from other taskforces join different taskforces?
12:44:31 <IvoL> .... if we show up in each others spaces, maybe we ask more questions instead at a presentation meeting
12:44:35 <brent> ack phila
12:45:24 <IvoL> phila: nobody wants more meetings, but what if you make the meeting not every week 1 hour but every other week 2 hours? specifically the wednesday working group meeting
12:45:30 <manu_> q+ to note 2 hours is difficult, alternating... maybe shutting down groups as they are safely in CR?
12:45:55 <IvoL> manu_: not a fan of that idea
12:46:00 <phila> ack next
12:46:01 <Zakim> manu_, you wanted to note 2 hours is difficult, alternating... maybe shutting down groups as they are safely in CR?
12:46:40 <IvoL> ... It is not a problem just yet, when taskforces are wrapping things up they could help other taskforces, but noticed that it is more work
12:47:06 <IvoL> ... for recognizedEntities, maybe stop meet weekly after the CR?
12:47:45 <IvoL> brent: Lunch is now, start at 13:30
12:48:34 <phila> RRSAgent, draft minutes
12:48:35 <RRSAgent> I have made the request to generate https://www.w3.org/2026/10/30-vcwg-minutes.html phila
12:51:15 <benoit> benoit has joined #vcwg
13:31:15 <wes-smith> wes-smith has joined #vcwg
13:32:32 <kezike> kezike has joined #vcwg
13:32:40 <kezike> present
13:32:40 <kezike> present+
13:33:10 <phila> phila has joined #vcwg
13:33:17 <kezike> Can’t hear anyone, but let me know when the group is ready for the VCALM presentation
13:34:54 <JennieM> JennieM has joined #vcwg
13:35:53 <YASUSHI0> YASUSHI0 has joined #VCWG
13:36:30 <kezike> This is the link to the VCALM presentation: https://docs.google.com/presentation/d/1-jXrkoqkdwEmaw-F4tHBzBiDtYMBkC6F3mBvMa5Rvo8/edit
13:36:34 <ElaineX> ElaineX has joined #vcwg
13:43:38 <GeorgeM> GeorgeM has joined #vcwg
13:49:31 <ElaineX> SCRIBE+
13:49:32 <phila> Topic: VCALM
13:50:34 <markus_sabadello> markus_sabadello has joined #vcwg
13:50:42 <manu_> manu_ has joined #vcwg
13:51:02 <wes-smith> scribe+
13:51:18 <ElaineX> ElaineX has joined #vcwg
13:51:23 <wes-smith> kezike: Going to talk today about the VCALM spec and its path to CR.
13:51:48 <wes-smith> ... Before VCALM was a concept we had the foundational VCDM specification, which specifies what a valid VC looks like, what properties are acceptable, and that existed in a vacuum.
13:52:02 <wes-smith> ... We needed a way to be able to do something with this VC, both from the standpoint of the issuer as well as the holder and the verifier.
13:52:16 <wes-smith> ... So we essentially needed a mechanism to enable exchanging and delivery/presentation of credentials.
13:52:25 <wes-smith> ... Generally, we need to manage the lifecycle of a VC under the three party model
13:52:37 <swcurran> present+
13:52:39 <wes-smith> ... It would be great if we could do this in a modular and extensible way without binding clients to vendor solutions.
13:52:46 <GeorgeM> present+
13:52:48 <ElaineX> ElaineX has joined #vcwg
13:53:10 <wes-smith> ... VCALM stands for VC API for Lifecycle Management - it's a set of HTTP apis for the different roles in the 3 party model.
13:53:21 <wes-smith> ... This helps the roles to manage the VCs that relate to them and exchange these VCs with other parties.
13:53:30 <wes-smith> ... It supports issuance, verification, presentation, and status management.
13:53:46 <wes-smith> ... It supports repeated actions in a single exchange - such as multiple credentials delivered to a holder.
13:54:03 <wes-smith> ... It also supports verification steps before issuance steps, as a feature that is worth calling out.
13:54:36 <wes-smith> ... We have a notion of an administrator who is responsible for configuring the different services that will be used by the other parties
13:54:47 <wes-smith> ... We are careful to not put too many restrictions on what admins can do or how they set up services.
13:54:59 <wes-smith> ... The important part is the output - this is a key part of the specification.
13:55:18 <wes-smith> ... The issuer is able to leverage an issuance service that the admin sets up, whether to do issuance, deliver a credential, or respond to an exchange request.
13:55:40 <wes-smith> ... The verifier is able to verify credentials that the holder presents.
13:55:59 <wes-smith> ... A coordinator is a component of a "role" that is responsible for business logic - preparing data that needs to go into a credential, for example.
13:56:08 <wes-smith> ... It acts on behalf of the different parties in the three party model.
13:56:24 <phila> q+
13:56:33 <phila> ack me
13:57:52 <wes-smith> phila: overview of GS1 structure - there is a GS1 root key. No individual has access to this - but there are two sets of three people, and you need a representative of each set to access the root key.
13:58:07 <wes-smith> ... This is similar to the presented VCALM notion of admin role.
13:58:27 <wes-smith> ... The people behind the "GS1" entity are individuals - which is an implementation choice, but it is an example of how this is implementable.
13:58:47 <wes-smith> ... It is also an example of the complexity you get when you put this into a real organization, with a notion of an "organizational signature".
13:59:11 <manu_> q+
13:59:45 <dmitriz> @phila -- this is similar to the Verifiable Governance presentation we did at CCG: https://docs.google.com/presentation/d/1Ws_7Fl2WIokXlRfBDafiFGZHT-Zev1CbqW2AOG5beJY/
14:00:02 <wes-smith> ... Anything signed by GS1 must be signed by someone who has the authority to sign contracts on the behalf of the organization - this is not something that would go into a spec, but gives you an idea of how "who controls a signature" maps to a real system.
14:00:03 <TallTed> "business logic"
14:00:21 <dmitriz> q+
14:00:37 <wes-smith> ... We want what we issue to have the same authority as a contract.
14:01:26 <wes-smith> kezike: A good thing about VCALM is how its flexibility can map to various business logics - it seems like GS1 has a good handle on how to do this.
14:01:28 <phila> ack manu_
14:01:58 <phila> ack dmitriz
14:02:00 <wes-smith> manu_: +1, I think what Phil is highlighting is that that group is acting as administrators of the system - that maps cleanly to the VCALM notion of administrator. That is the administrative component of VCALM.
14:02:17 <ivan> present+ dmitriz
14:02:31 <wes-smith> dmitriz: I think this is an important use case - it's similar to work we did in the CCG about verifiable governance. How do you sign as a group or a corporation? That touches on work we need to do in the DID WG.
14:02:49 <wes-smith> ... There is some dormant work in the WG related to this as well.
14:03:13 <wes-smith> ... Tying it back to VCALM, I think at present VCALM is flexible enough as an API to support the kind of API you need for this use case.
14:03:23 <wes-smith> phila: This is largely an implementation choice.
14:04:20 <wes-smith> kezike: I felt that it's important to nod to the Interaction URL/Protocol features of the spec - this is an entry point for different parties to engage in a credential exchange. We don't specify how a URL is sent to a party - but any party that supports VCALM should understand Interaction URLs, which is a way to advertise protocols that a component
14:04:20 <wes-smith> supports for credential exchange.
14:04:51 <wes-smith> ... VCALM uses exchange URLs for this, but we also support other protocols such as OID4*.
14:05:03 <wes-smith> ... Once this is advertised to a holder's wallet they can then decide what to do with it.
14:05:21 <wes-smith> ... Then, messages exchange against that URL will abide by the protocol that they have selected.
14:05:32 <wes-smith> ... VCALM responses are mostly VP/VPRs.
14:05:44 <wes-smith> ... The latter of which is a way to query for credentials that are desired in an exchange.
14:05:54 <wes-smith> ... Often times this can be presented as a QR code.
14:06:09 <wes-smith> phila: Have you registered a .well-known for this?
14:06:25 <wes-smith> manu_: We have registered a protocol scheme at IETF, if that's what you are asking.
14:06:31 <manu_> q+
14:06:33 <wes-smith> phila: Noting that the domain name there has a particular behavior.
14:06:40 <phila> ack manu_
14:07:09 <wes-smith> manu_: This is a protocol agnostic way of engaging with a digital wallet. It is the only such thing we know of that exists that doesn't try to tip the scales towards a particular protocol.
14:07:29 <wes-smith> ... Whatever protocol you want to use, we are happy for you to use it - and the application gets to choose what protocol or set of protocols to use.
14:07:52 <wes-smith> ... This is critical to how VCALM bootstraps in various use cases.
14:08:07 <wes-smith> kezike: We have received feedback from i18n, they have given us a review with three open issues.
14:08:18 <wes-smith> ... We have PRs that have been created to address them - some merged, some in flight.
14:08:23 <wes-smith> ... We heard back from TAG recently as well.
14:08:42 <wes-smith> ... We will be processing accessibility's review soon, and have not heard back from PING/SING.
14:09:35 <wes-smith> ... Most of the existing PRs are close to being resolved, and as far as issues go we need to do a pass to get a sense of what are v1 blockers.
14:09:43 <wes-smith> s/what/which
14:10:05 <wes-smith> ... Some of the issues are editorial things, some are nice-to-have features, we need to process them as such.
14:11:46 <wes-smith> ... Topics we are still processing include JSONata and how to reference it, test suite, a final normative statement review (related to some TAG confusion about normative boundaries).
14:12:00 <wes-smith> ... We have made decisions editorially to trim things down, as repetition throughout the spec would cause clutter.
14:12:44 <wes-smith> ... We have made a lot of great progress on threat modeling - we need to process our NOTE and to refine some examples and diagrams.
14:12:51 <wes-smith> ... Any questions about the current state of the specification?
14:13:25 <benoit__> benoit__ has joined #vcwg
14:13:44 <wes-smith> ... The current plan for moving to CR is to merge the open PRs that we have, refine the spec as I mentioned earlier as far as statements, examples, diagrams, close out reviews, and finalizing the test suite. Q1 2027 is the target.
14:14:03 <wes-smith> ... Nothing is super exigent, but we need more than the final quarter.
14:14:16 <wes-smith> ... I turn it over to the group to decide what is top of mind.
14:14:17 <wes-smith> q+
14:14:26 <ElaineX> scribe+
14:14:39 <phila> ack wes-smith
14:15:53 <ElaineX> wes-smith : manu briefed on use cases - explaining DC API may not be the best choice
14:16:43 <ElaineX> s/DC/VC
14:18:00 <ElaineX> ... Manu briefed web payments based on his experience / need to have working group members also share this kind of info during engagement with others
14:18:08 <manu_> q+ to note that VCWG is likely to be ignored if we do not engage as a WG.
14:18:41 <markus_sabadello> markus_sabadello has joined #vcwg
14:18:48 <kezike> q+
14:18:58 <wes-smith> phila: It's good to be able to point to concrete things such as GitHub issues when we interact with other WGs. Manu's slides made clear that the obstacles to VCALM's inclusion in the DC API include not just the working group but other organizations.
14:19:03 <phila> ack manu_
14:19:04 <Zakim> manu_, you wanted to note that VCWG is likely to be ignored if we do not engage as a WG.
14:20:21 <wes-smith> manu_: If we do not start conveying these things as a WG, we will be ignored. That is the default path that we are on. We have said these things multiple times over multiple years, and the response has been "why didn't you raise an issue/bring it up"? We should, and this is a request to the chairs, can we please coordinate the group's responses to
14:20:22 <wes-smith> things. We have done this such as with a recent press release and group visibility on the fedId presentation.
14:20:44 <phila> q+
14:20:49 <wes-smith> ... The base assumption is that we may not get traction in other groups, and need to design paths forward that are not reliant on that.
14:21:47 <kseufer> kseufer has joined #vcwg
14:22:12 <wes-smith> q+
14:22:55 <phila> ack wes-smith
14:23:29 <phila> ack kezike
14:23:56 <Wip> Wip has joined #vcwg
14:24:15 <Wip> q+
14:24:38 <phila> ack Wip
14:24:46 <wes-smith> q+
14:25:20 <phila> ack wes-smith
14:26:20 <wes-smith> phila: Devil's advocate, how easy will it be to prove the value of VCALM by implementing it in places we do control?
14:26:27 <wes-smith> manu_: That is our current direction.
14:26:29 <phila> ack me
14:26:37 <manu_> q+
14:26:48 <wes-smith> ivan: Having a PR raised with possible changes on their specification, if it is not an inordinate amount of work, would be good to have.
14:27:01 <wes-smith> ... This must be responded to explicitly.
14:27:15 <kezike> To that point, we may need to be better about advertising/marketing the different deployment instances in the wild (re: engaging as a group).
14:27:16 <phila> ack manu_
14:27:18 <wes-smith> phila: I may be optimistic, but there are good communications between the groups.
14:27:27 <Lucy> Lucy has joined #vcwg
14:30:00 <wes-smith> phila: going back to JSONata for VCALM, VCALM requires JSONata, yes?
14:30:00 <manu_> q+
14:30:15 <wes-smith> kezike: It can work without it but is used for credential templating.
14:30:44 <wes-smith> phila: Where we got to earlier was that it would be ok to say "you have to be able to do this, and here is one way of doing it".
14:30:44 <phila> ack manu_
14:31:36 <wes-smith> manu_: In this case, for VCALM's use of JSONata, it's easier. We make no normative references in VCALM. There are step templates for workflows (identify yourself, present other credentials, etc) and we use JSONata to dynamically configure those steps.
14:32:07 <wes-smith> ... All of the examples are JSONata, but we can say "use a templating language".
14:32:20 <wes-smith> ... We can say JSONata is one way to do it. kezike, do you agree with that framing?
14:33:07 <wes-smith> kezike: I remember discussion about this in the past - originally there was no explicit reference to JSONata, and there was an unspecified template type. JSONata is supposed to be optional, and we can make that clear.
14:33:19 <wes-smith> ... It's hard to express what we expect for most systems to be able to understand.
14:33:22 <dezell> dezell has joined #vcwg
14:33:25 <wes-smith> ... Generally, +1 to manu_.
14:33:32 <dezell> present+ David_Ezell
14:33:53 <wes-smith> ... My understanding is that approach requires no normative language, but only express options - that moves us back to the open world case, where there is no central authority for template types.
14:34:04 <wes-smith> s/express/expresses
14:34:23 <wes-smith> ... Thank you for your attention!
14:34:52 <wes-smith> phila: We're glad to see the Q1 target - we are pursuing a F2F meeting in April, we aren't sure where it will be yet.
14:35:05 <wes-smith> ... CR is the target for that meeting across specs.
14:35:15 <wes-smith> Ivan: Will the presentations be added to the agenda slide set?
14:35:30 <wes-smith> kezike: I will link to my slides in the chat.
14:35:32 <dlehn1> dlehn1 has joined #vcwg
14:35:43 <wes-smith> Ivan: We need URLs for previous slide decks.
14:35:50 <wes-smith> phila: We have render method and recognized entities.
14:35:55 <wes-smith> ... I don't think the ones that were just presented are there.
14:36:24 <phila> Topic: Barcodes and DI
14:36:40 <ElaineX> phila : wes is next - barcodes and more
14:37:57 <ElaineX> wes-smith : one of the co-heads of barcodes, data integrity, forgery defence and bitstring status list specs
14:38:40 <ElaineX> ... will share overview, some info about what problems specs address and some issues
14:38:47 <kezike> Just posted the VCALM slides at the end of the main VCWG TPAC deck: https://docs.google.com/presentation/d/19vlKzO5nZjsVMVPmuI40jdSGW3kGUtAC1ngW-yQOC6g/edit
14:39:35 <ElaineX> ... VC-> data integrity-> cbor-ld for compression -> vc barcode for issuance
14:40:15 <ElaineX> ... data integrity --> bitstring status list --> forgery defense / how all the specs fit together
14:40:54 <ElaineX> ... barcodes is about security physical document with VC
14:41:36 <markus_sabadello> markus_sabadello has joined #vcwg
14:41:46 <ElaineX> ... press release was done a few weeks ago in response to leak of huge number of driver license images in the US (160 million) - threat is exactly what VC barcodes gives a defense
14:42:34 <ElaineX> ... image of PDF417 barcode with a VC - can achieve tamper-proof-ness for all of the data not just the VC
14:44:29 <ElaineX> ... road to CR - have heard back from security privacy accessibility i18n  - no feedback yet from TAG / some work needed on tech boundaries
14:45:18 <ElaineX> ... for example, cryptosuite was designated and this probably doesn't make sense / need to update test vectors - they are correct for spec but should be useful out of spec
14:46:32 <ElaineX> ivan : what about CBOR LD?
14:46:48 <dmitriz> q+
14:47:09 <phila> ack dmitriz
14:47:16 <ElaineX> wes-smith : yes there's a normative issue - so both are being worked on in parallel
14:48:01 <ElaineX> dmitriz : on behalf of Lucy - market research on use of VC barcode?
14:49:09 <ElaineX> wes-smith : in production in California / what else is driving VC barcode? others have expressed an interest in adding VC Barcode which gives some security to an otherwise just printed piece of paper
14:49:35 <ElaineX> ... add cryptographic security
14:50:38 <phila> q+
14:50:46 <ElaineX> question by Lucy - followup question about verifier use of VC barcodes
14:51:42 <markus_sabadello> markus_sabadello has joined #vcwg
14:51:45 <ElaineX> wes-smith : in response to inclusion of biometric mentioned by Lucy - California has an implementation of instant ID which includes a biometric
14:51:56 <phila> ack me
14:52:04 <ElaineX> ... VC barcodes supports this and is in production
14:52:49 <ElaineX> phila : no such thing as a verifiable barcode / you get a signal that there's a barcode - then use a routine to get the info
14:53:32 <ElaineX> wes-smith : next is data integrity - this is the digital signing part of the VCs
14:55:37 <ElaineX> ... transform / hash / prove is the model - relies on signatures / includes selective disclosure and unlinkability - present as a barcode  and use quantum resistant crypto
14:56:28 <hsxavier> hsxavier has joined #VCWG
14:56:39 <ElaineX> ... recent work - how to deal with selective disclosure - there are cryptosuites that are better for this
14:57:24 <ElaineX> ... sign individual claims / sign a list of hashes (SHoC) / multi-claim signature (MCS) - see BBS
14:57:57 <ElaineX> ... road to CR - next step is horizontal review
14:58:56 <swcurran> q+
14:58:56 <ElaineX> ivan : Greg's refactorization - adding another cryptosuite became a "piece of cake" / will be a one pager to add another
14:59:03 <phila> ack swcurran
14:59:42 <ElaineX> swcurran : where do we need to put them?  in W3C?
14:59:52 <ElaineX> phila : anywhere
15:00:16 <phila> s/phila/ivan/
15:00:44 <ElaineX> wes-smith : next is forgery defense - started recently - response to quantum looming
15:02:26 <ElaineX> ... the long description of forgery defense is "secondary authenticity checks with randomized and anonymized hash witnesses"
15:02:58 <manu_> q?
15:02:59 <ElaineX> ... the mechanism is not about quantum - it deals with key compromise - which can happen with Quantum compromise
15:03:46 <dmitriz> @phila -- from Lucy: Thanks, Phil. I understood what you meant (And I should have used the full and correct term). While the barcode is standardized and can be processed by readers, if the readers can’t read VC data, the standard is not considered useful enough even if California is issuing it. It is the issue one government is facing getting their W3C-based mobile driver’s license verified in California even though it is not in a barcode
15:03:46 <dmitriz>  format. At the end of the day, it is a W3C-VC adoption issue however you deliver it. I just wanted to point out and put myself on record that we are facing a lot of market challenges because most of the current readers don’t read W3C VCs and understanding where others are playing will help us better understand real adoption challenges.
15:04:54 <ElaineX> ... check signature using key - if key is compromised then that has limited value / forgery defense creates a separate credential - a witness list - which is signed with a quantum resistant algorithm
15:05:30 <ElaineX> ... it's a secondary authenticity guarantee
15:05:59 <ElaineX> ... can piggyback on bitstring status list / can point to the witness list in the credential or standalone mode
15:06:06 <manu_> q?
15:07:14 <ElaineX> ... road to CR - address boundaries / no threat model - share with others in this group / review algorithm / haven't submitted for HR yet
15:08:11 <ElaineX> phila : completion date - to CR - by end of Q1?
15:08:18 <ElaineX> wes-smith : yes
15:09:20 <ElaineX> ... next is Bitstring Status List - image is more of a block than a list - if you contact the issuer it's not privacy protecting - so what do we do?
15:10:13 <ElaineX> ... anonymize and mix together lots of credentials / can't be massive - so make it reasonable size to process
15:11:24 <ElaineX> ... this is 1.1 version to update form 1.0 in order to align with the other related specs / resolving some past future issues that aren't substantive
15:12:26 <ElaineX> ivan : think we should reduce the work to do on this spec to a minimum / even for horizontal review remind them that they already reviewed most of it - focus on the changed part
15:13:27 <ElaineX> wes-smith : whoever submits this for HR - should be clear to describe what has happened and ask for focus on the changed part
15:14:22 <phila> q+
15:14:24 <ElaineX> ... discussion of HR of the cryptosuites - propose to submit them bundled together
15:16:17 <phila> ack me
15:16:20 <ElaineX> ivan : similar issue with HR - there has been limited (editorial) change to the three (not quantum resistant) - don't ask for technical review for them / Quantum resistant will need technical review / also have to wait for BBS
15:16:54 <ElaineX> phila : since most content hasn't changed - let's write to the chairs for HR and ask them how to proceed
15:17:09 <ElaineX> ... crosstalk of everyone agreeing to that
15:18:41 <manu_> q+
15:18:49 <phila> ack manu_
15:18:51 <ElaineX> wes-smith : this modifies the proposal from my slides
15:19:49 <ElaineX> manu : working group still has to agree (do a formal resolution) to ask for horizontal review?  cross-talk results in "yes"
15:20:41 <wes-smith> PROPOSAL: The VCWG requests horizontal review of Data Integrity v1.1, ECDSA v1.1, EDDSA v1.1, and Quantum-Resistant v1.0 cryptosuites.
15:20:43 <wes-smith> +1
15:20:48 <manu_> +1
15:20:50 <dmitriz> +1
15:20:52 <ElaineX> +1
15:20:54 <phila> +1
15:20:56 <dmitriz> q+
15:20:56 <kezike> +1
15:20:58 <ivan> +1
15:21:04 <shigeya> +1
15:21:05 <phila> ack dmitriz
15:21:10 <JennieM> +1
15:21:30 <Wip> +1
15:21:39 <phila> RESOLUTION: The VCWG requests horizontal review of Data Integrity v1.1, ECDSA v1.1, EDDSA v1.1, and Quantum-Resistant v1.0 cryptosuites.
15:22:11 <ElaineX> wes-smith : engagement with other standards groups
15:22:14 <pdl-asu> +1
15:23:22 <ElaineX> ... groups at ISO are interested in learning more bitstring status list and forgery defense
15:24:29 <ElaineX> ivan : can talk to them - anything more needs more discussion
15:24:51 <ElaineX> wes-smith : we need to represent the group not speak as individuals
15:25:46 <wes-smith> Proposal: The VCWG supports the VCB/DI task force's presentation of the VC Forgery Defense and Bitstring Status List technologies to ISO groups on behalf of the WG, coordinated if necessary by the chairs and staff through the group liaison.
15:26:03 <manu_> +1
15:26:03 <wes-smith> +1
15:26:04 <ElaineX> +1
15:26:06 <kezike> +1
15:26:06 <shigeya> +1
15:26:07 <ivan> +1
15:26:07 <denkeni> +1
15:26:07 <JennieM> +1
15:26:08 <ElaineX> q+
15:26:09 <Wip> +1
15:26:09 <dezell> dezell has joined #vcwg
15:26:10 <phila> +1
15:26:10 <dmitriz> +1
15:26:24 <phila> RESOLUTION: The VCWG supports the VCB/DI task force's presentation of the VC Forgery Defense and Bitstring Status List technologies to ISO groups on behalf of the WG, coordinated if necessary by the chairs and staff through the group liaison.
15:26:25 <manu_> scribe+
15:26:38 <phila> ack ElaineX
15:26:39 <pdl-asu> +1
15:27:22 <ivan> present+ pdl-asu
15:27:22 <manu_> ElaineX: In addition to being in W3C and ISO, I'm in the ISO spec. That group has created taskforce7, webinars, social media, to promote the standard. This group might consider something similar so people know what we're doing.
15:28:05 <manu_> phila: Yes, W3C does not usually do that, but we should do this, it's important. If we're making material that we expect to publish that explains what we do, we might want to have the group review before we release it.
15:28:32 <phila> Topic: TAG review of render method
15:28:47 <ElaineX> scribe+
15:29:36 <Lucy> Lucy has joined #vcwg
15:30:47 <ivan> -> list or resolutions https://w3c.github.io/vc-wg/minutes/resolutions.html
15:31:07 <ivan> rrsagent, draft minutes
15:31:08 <RRSAgent> I have made the request to generate https://www.w3.org/2026/10/30-vcwg-minutes.html ivan
15:31:10 <ElaineX> phila : anything else we want to say? if not, no VC WG meetings next week.  We restart the next week.
15:31:12 <ivan> rrsagent, draft minutes
15:31:13 <RRSAgent> I have made the request to generate https://www.w3.org/2026/10/30-vcwg-minutes.html ivan
15:31:20 <ivan> rrsagent, bye
15:31:20 <RRSAgent> I see no action items