archetech / archon / 36473646044

87%

main: 87%

Pull #1301

github

fix(keymaster): bind verified credentials to their issuer, asset and request

Response verification in both ports now counts a presented credential
only when both envelopes carry equal cipher hashes, the credential has a
valid proof by its declared issuer, it lives at the presented DID (its
signed id, or issuer control of the asset for credentials without one),
and it names a schema an unsatisfied challenge request accepts. Each
request is satisfied once, each credential DID counts once, and match
means every request is satisfied.

Each case was reachable with real signed operations before this change:
a holder could self-sign a credential naming a trusted issuer, copy a
revoked credential to a new asset, present a schema-less or unhashed
credential, or repeat one credential to satisfy several requests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

66 of 76 branches covered (86.84%)

Branch coverage included in aggregate %.

12 of 14 relevant lines covered (85.71%)

12.57 hits per line