Didvc phase 01

.github/workflows/didvc-conformance.yml

@@ -0,0 +1,106 @@
+name: DID-VC conformance and wallet interop
+
+# OpenID OID4VCI/OID4VP conformance (T-2.3/T-3.1) plus the
+# reference-wallet round trip (T-2.1). The conformance suite is hosted by
+# the OpenID Foundation and reaches the edge through a cloudflared quick
+# tunnel; the wallet round trip runs fully locally against a demo-profile
+# edge using the OpenWallet Foundation @openid4vc client libraries.
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [didvc-phase-01]
+    paths:
+      - 'didvc/**'
+  pull_request:
+    paths:
+      - 'didvc/**'
+
+# The hosted conformance suite needs an API token (GitHub secret
+# OPENID_SUITE_TOKEN); without it the openid-conformance job skips with
+# a notice so unconfigured forks stay green, while the wallet-interop
+# job (fully local) always runs.
+env:
+  HAS_SUITE_TOKEN: ${{ secrets.OPENID_SUITE_TOKEN != '' }}
+
+jobs:
+  wallet-interop:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Build edge
+        run: mvn -B -pl didvc/didvc-edge -am package -DskipTests
+      - name: Start edge (demo profile, HTTPS)
+        run: |
+          # Per-run key generated in CI — never a committed literal
+          export DIDVC_INTERNAL_API_KEY="ci-$(date +%s)-$RANDOM"
+          keytool -genkeypair -alias edge -keyalg RSA -keysize 2048 -storetype PKCS12 \
+            -keystore /tmp/edge.p12 -storepass changeit -keypass changeit \
+            -dname "CN=localhost, O=HKT DID-VC" -ext "SAN=dns:localhost,ip:127.0.0.1" -validity 3650
+          keytool -exportcert -alias edge -keystore /tmp/edge.p12 -storepass changeit -rfc -file /tmp/localhost-cert.pem
+          java -jar didvc/didvc-edge/target/unomi-did-vc-edge-3.1.0-SNAPSHOT.jar \
+            --spring.profiles.active=demo --server.port=8081 \
+            --server.ssl.key-store-type=PKCS12 --server.ssl.key-store=file:/tmp/edge.p12 \
+            --server.ssl.key-store-password=changeit --server.ssl.key-alias=edge \
+            --didvc.edge.internal-api-key="$DIDVC_INTERNAL_API_KEY" \
+            --didvc.edge.issuer-base-url=https://localhost:8081 &
+          for i in $(seq 1 30); do
+            curl -sk https://localhost:8081/demo/issuer-kid && break
+            sleep 2
+          done
+          echo "DIDVC_INTERNAL_API_KEY=$DIDVC_INTERNAL_API_KEY" >> "$GITHUB_ENV"
+      - name: Run reference-wallet round trip
+        working-directory: didvc/interop
+        env:
+          NODE_EXTRA_CA_CERTS: /tmp/localhost-cert.pem
+          DIDVC_INTERNAL_API_KEY: ${{ env.DIDVC_INTERNAL_API_KEY }}
+        run: |
+          npm install --no-audit --no-fund
+          npx tsx wallet-roundtrip.ts
+
+  openid-conformance:
+    runs-on: ubuntu-latest
+    needs: wallet-interop
+    if: env.HAS_SUITE_TOKEN == 'true' || github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Notice when the suite token is not configured
+        if: env.HAS_SUITE_TOKEN != 'true'
+        run: |
+          echo "OPENID_SUITE_TOKEN is not configured — the hosted suite will be"
+          echo "attempted unauthenticated (local-suite mode also works via"
+          echo "OPENID_SUITE_API). Set the secret to enable certified runs."
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+      - name: Install cloudflared
+        run: |
+          curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
+          sudo dpkg -i cloudflared.deb
+      - name: Build edge
+        run: mvn -B -pl didvc/didvc-edge -am package -DskipTests
+      - name: Start edge (demo profile)
+        run: |
+          # Per-run key generated in CI — never a committed literal
+          INTERNAL_API_KEY="ci-$(date +%s)-$RANDOM"
+          java -jar didvc/didvc-edge/target/unomi-did-vc-edge-3.1.0-SNAPSHOT.jar \
+            --spring.profiles.active=demo --server.port=8081 \
+            --didvc.edge.internal-api-key="$INTERNAL_API_KEY" \
+            --didvc.edge.issuer-base-url=http://localhost:8081 &
+          for i in $(seq 1 30); do
+            curl -s http://localhost:8081/demo/issuer-kid && break
+            sleep 2
+          done
+      - name: Run OpenID conformance suite
+        run: bash didvc/scripts/run-openid-conformance.sh
+        env:
+          OPENID_SUITE_API: https://api.certification.openid.net
+          OPENID_SUITE_TOKEN: ${{ secrets.OPENID_SUITE_TOKEN }}

.mimosa/finding-ledger/v1/events/batch-posttooluse-52e3530b1560818a1b19a9d170304d27.json

@@ -0,0 +1,48 @@
+{
+  "schemaVersion": "mimosa-finding-ledger-batch/v1",
+  "batchId": "posttooluse-52e3530b1560818a1b19a9d170304d27",
+  "runId": null,
+  "runStatus": "completed",
+  "coverage": {
+    "status": "complete",
+    "reasons": []
+  },
+  "source": {
+    "component": "zcode-hook",
+    "operationId": "PostToolUse"
+  },
+  "revision": null,
+  "diffHash": null,
+  "rulesVersion": null,
+  "sessionHash": "087bd128ccdb296ffb720c2c6e0459fa33d703c8d4b11da887dbbf108c3d5376",
+  "reportRef": null,
+  "events": [
+    {
+      "eventId": "hook-4efacc4243c98c84bedc7bd8a64f910c",
+      "findingId": "mimosa-99bd954a8b5ded6e28df9118",
+      "type": "static_fix_verified",
+      "at": "2026-08-28T14:15:32.977Z",
+      "identity": {
+        "projectRelativeFile": "didvc/interop/load-test.ts",
+        "ruleId": "security",
+        "codeEvidenceHash": "6432b6b40d93d2ba9408b699c9a67586768d96062333619ccfc830fbb32f6b08",
+        "confidence": "stable"
+      },
+      "scope": "direct",
+      "line": 69,
+      "endLine": 69,
+      "reasonCode": "static_rescan_passed",
+      "reportedToAgent": false,
+      "evidence": {
+        "kind": "static_scan",
+        "boundary": "observed",
+        "producer": "deterministic",
+        "evidenceHash": "6432b6b40d93d2ba9408b699c9a67586768d96062333619ccfc830fbb32f6b08"
+      },
+      "sequence": 0
+    }
+  ],
+  "observedFindingIds": [],
+  "verifiedFiles": [],
+  "recordedAt": "2026-08-28T14:15:33.595Z"
+}

.mimosa/finding-ledger/v1/events/batch-posttooluse-85d045af4d5a122e3ac1a2f1d75d9b36.json

@@ -0,0 +1,72 @@
+{
+  "schemaVersion": "mimosa-finding-ledger-batch/v1",
+  "batchId": "posttooluse-85d045af4d5a122e3ac1a2f1d75d9b36",
+  "runId": null,
+  "runStatus": "completed",
+  "coverage": {
+    "status": "complete",
+    "reasons": []
+  },
+  "source": {
+    "component": "zcode-hook",
+    "operationId": "PostToolUse"
+  },
+  "revision": null,
+  "diffHash": null,
+  "rulesVersion": null,
+  "sessionHash": "07679adc850d3b0cb3ae54a843f7a8018bc5a95b49818d1d62fa602a9efdb9f8",
+  "reportRef": null,
+  "events": [
+    {
+      "eventId": "hook-ea8f0b2caaf86c7c9414d6ba9f75100a",
+      "findingId": "mimosa-6b83b4090a361285dfc4b9d4",
+      "type": "static_fix_verified",
+      "at": "2026-08-29T10:04:35.436Z",
+      "identity": {
+        "projectRelativeFile": "didvc/didvc-services/src/test/java/org/apache/unomi/didvc/services/impl/Pkcs11KeyMaterialProviderTest.java",
+        "ruleId": "security",
+        "codeEvidenceHash": "958ad8f7ca6b9db8710f20489b51161a4e0653f18e336a5cd2d82308277ea222",
+        "confidence": "stable"
+      },
+      "scope": "direct",
+      "line": 109,
+      "endLine": 109,
+      "reasonCode": "static_rescan_passed",
+      "reportedToAgent": false,
+      "evidence": {
+        "kind": "static_scan",
+        "boundary": "observed",
+        "producer": "deterministic",
+        "evidenceHash": "958ad8f7ca6b9db8710f20489b51161a4e0653f18e336a5cd2d82308277ea222"
+      },
+      "sequence": 0
+    },
+    {
+      "eventId": "hook-651d6e9b515e3bec7d2a2acca8fe8352",
+      "findingId": "mimosa-34541f18fe794e05ff5d0bde",
+      "type": "static_fix_verified",
+      "at": "2026-08-29T10:04:35.436Z",
+      "identity": {
+        "projectRelativeFile": "didvc/didvc-services/src/test/java/org/apache/unomi/didvc/services/impl/Pkcs11KeyMaterialProviderTest.java",
+        "ruleId": "security",
+        "codeEvidenceHash": "fd406a10dcbdadd200034dabf56d4581f46ec280e71294ceac64d7d114ed4a69",
+        "confidence": "stable"
+      },
+      "scope": "direct",
+      "line": 121,
+      "endLine": 121,
+      "reasonCode": "static_rescan_passed",
+      "reportedToAgent": false,
+      "evidence": {
+        "kind": "static_scan",
+        "boundary": "observed",
+        "producer": "deterministic",
+        "evidenceHash": "fd406a10dcbdadd200034dabf56d4581f46ec280e71294ceac64d7d114ed4a69"
+      },
+      "sequence": 1
+    }
+  ],
+  "observedFindingIds": [],
+  "verifiedFiles": [],
+  "recordedAt": "2026-08-29T10:04:36.094Z"
+}

.mimosa/finding-ledger/v1/events/batch-pretooluse-0a6ac734ea2cb3d0d369d1fd0b230f82.json

@@ -0,0 +1,48 @@
+{
+  "schemaVersion": "mimosa-finding-ledger-batch/v1",
+  "batchId": "pretooluse-0a6ac734ea2cb3d0d369d1fd0b230f82",
+  "runId": null,
+  "runStatus": "completed",
+  "coverage": {
+    "status": "complete",
+    "reasons": []
+  },
+  "source": {
+    "component": "zcode-hook",
+    "operationId": "PreToolUse"
+  },
+  "revision": null,
+  "diffHash": null,
+  "rulesVersion": null,
+  "sessionHash": "07679adc850d3b0cb3ae54a843f7a8018bc5a95b49818d1d62fa602a9efdb9f8",
+  "reportRef": null,
+  "events": [
+    {
+      "eventId": "hook-bc6c1e0e95a05726a3c11d057daf17c2",
+      "findingId": "mimosa-6b83b4090a361285dfc4b9d4",
+      "type": "finding_blocked",
+      "at": "2026-08-29T10:03:29.859Z",
+      "identity": {
+        "projectRelativeFile": "didvc/didvc-services/src/test/java/org/apache/unomi/didvc/services/impl/Pkcs11KeyMaterialProviderTest.java",
+        "ruleId": "security",
+        "codeEvidenceHash": "958ad8f7ca6b9db8710f20489b51161a4e0653f18e336a5cd2d82308277ea222",
+        "confidence": "stable"
+      },
+      "scope": "direct",
+      "line": 109,
+      "endLine": 109,
+      "reasonCode": "deny",
+      "reportedToAgent": true,
+      "evidence": {
+        "kind": "source",
+        "boundary": "candidate",
+        "producer": "deterministic",
+        "evidenceHash": "958ad8f7ca6b9db8710f20489b51161a4e0653f18e336a5cd2d82308277ea222"
+      },
+      "sequence": 0
+    }
+  ],
+  "observedFindingIds": [],
+  "verifiedFiles": [],
+  "recordedAt": "2026-08-29T10:03:30.517Z"
+}

.mimosa/finding-ledger/v1/events/batch-pretooluse-896cc431119992e1aaed3ccc0cc2521e.json

@@ -0,0 +1,48 @@
+{
+  "schemaVersion": "mimosa-finding-ledger-batch/v1",
+  "batchId": "pretooluse-896cc431119992e1aaed3ccc0cc2521e",
+  "runId": null,
+  "runStatus": "completed",
+  "coverage": {
+    "status": "complete",
+    "reasons": []
+  },
+  "source": {
+    "component": "zcode-hook",
+    "operationId": "PreToolUse"
+  },
+  "revision": null,
+  "diffHash": null,
+  "rulesVersion": null,
+  "sessionHash": "07679adc850d3b0cb3ae54a843f7a8018bc5a95b49818d1d62fa602a9efdb9f8",
+  "reportRef": null,
+  "events": [
+    {
+      "eventId": "hook-8afd6cb5ceb965b79adcab4a1824f8b5",
+      "findingId": "mimosa-34541f18fe794e05ff5d0bde",
+      "type": "finding_blocked",
+      "at": "2026-08-29T10:04:03.614Z",
+      "identity": {
+        "projectRelativeFile": "didvc/didvc-services/src/test/java/org/apache/unomi/didvc/services/impl/Pkcs11KeyMaterialProviderTest.java",
+        "ruleId": "security",
+        "codeEvidenceHash": "fd406a10dcbdadd200034dabf56d4581f46ec280e71294ceac64d7d114ed4a69",
+        "confidence": "stable"
+      },
+      "scope": "direct",
+      "line": 121,
+      "endLine": 121,
+      "reasonCode": "deny",
+      "reportedToAgent": true,
+      "evidence": {
+        "kind": "source",
+        "boundary": "candidate",
+        "producer": "deterministic",
+        "evidenceHash": "fd406a10dcbdadd200034dabf56d4581f46ec280e71294ceac64d7d114ed4a69"
+      },
+      "sequence": 0
+    }
+  ],
+  "observedFindingIds": [],
+  "verifiedFiles": [],
+  "recordedAt": "2026-08-29T10:04:04.397Z"
+}

.mimosa/finding-ledger/v1/events/batch-pretooluse-b46c5b1a6c550dcfa5ff6170d0f2212b.json

@@ -0,0 +1,48 @@
+{
+  "schemaVersion": "mimosa-finding-ledger-batch/v1",
+  "batchId": "pretooluse-b46c5b1a6c550dcfa5ff6170d0f2212b",
+  "runId": null,
+  "runStatus": "completed",
+  "coverage": {
+    "status": "complete",
+    "reasons": []
+  },
+  "source": {
+    "component": "zcode-hook",
+    "operationId": "PreToolUse"
+  },
+  "revision": null,
+  "diffHash": null,
+  "rulesVersion": null,
+  "sessionHash": "087bd128ccdb296ffb720c2c6e0459fa33d703c8d4b11da887dbbf108c3d5376",
+  "reportRef": null,
+  "events": [
+    {
+      "eventId": "hook-cb0cada72a81e16d9c32fb97f735d5e1",
+      "findingId": "mimosa-99bd954a8b5ded6e28df9118",
+      "type": "finding_blocked",
+      "at": "2026-08-28T14:14:57.907Z",
+      "identity": {
+        "projectRelativeFile": "didvc/interop/load-test.ts",
+        "ruleId": "security",
+        "codeEvidenceHash": "6432b6b40d93d2ba9408b699c9a67586768d96062333619ccfc830fbb32f6b08",
+        "confidence": "stable"
+      },
+      "scope": "direct",
+      "line": 69,
+      "endLine": 69,
+      "reasonCode": "deny",
+      "reportedToAgent": true,
+      "evidence": {
+        "kind": "source",
+        "boundary": "candidate",
+        "producer": "deterministic",
+        "evidenceHash": "6432b6b40d93d2ba9408b699c9a67586768d96062333619ccfc830fbb32f6b08"
+      },
+      "sequence": 0
+    }
+  ],
+  "observedFindingIds": [],
+  "verifiedFiles": [],
+  "recordedAt": "2026-08-28T14:14:58.554Z"
+}