Quarterly spec radar: vc-di-bbs, ELM/Europass, OB Future-Version candidates (watch, don't build)

[luisgf]

Horizon: long (recurring; zero build cost) · 2026-07 roadmap analysis · refreshed 2026-07-17 (round 3, #249)

Quarterly watch list — explicitly not build items. Prototype only if something reaches Recommendation or demand shows up with a name attached.

• vc-di-bbs (unlinkable selective disclosure): still Candidate Recommendation Draft (latest 2026-04-07), explicitly blocked on the IETF CFRG BBS / Blind BBS / Pseudonym BBS RFCs plus the two-implementations exit criterion. New signal: 1EdTech spec issue #640 (2026-06-25) proposes admitting bbs-2023 as an allowed (not required) suite for OB3/CLR via errata, keeping EdDSA required for conformance. Signal up, status unchanged — building on a draft is still a bet.

• Render Method / Confidence Method v1.0 (new, from the 2026 W3C VC WG recharter, 2026-03-11 → 2028-03-31; both targeted ~2026): render hints for credential display are directly badge-shaped. Watch for REC + a 1EdTech reference from OB3; prototype only then. (The other rechartered deliverables — VC API, Barcodes, Verifiable Issuers & Verifiers — target 2028; ignore for now.)

• Data Integrity v1.1 maintenance drafts (vc-di-ecdsa 1.1 FPWD, vc-di-eddsa 1.1, Bitstring Status List 1.1 editor's drafts): the v1.0 RECs of 2025-05-15 stay authoritative. When 1.1s publish, watch for normative deltas and new/changed contexts — the fail-closed allowlist + drift watchdog cover the pinned set (proven on OB3 errata v1.6, absorbed 2026-07), the radar watches for the normative side.

• ELM / Europass / DC4EU crosswalk: ELM v3.3 (2025) is LTS with no 2026 version; no published OB3↔ELM crosswalk exists; DC4EU funding ended 2025-07 and the "Beyond DC4EU" report (~2026-02) warns of fragmentation with no funded successor confirmed. An Achievement→ELM mapping would position the lib as a 1EdTech↔EU bridge — when the target stops moving. Unchanged: watch.

• OB "Future Version" candidates (radar of what NOT to over-build): #610 hashed/salt problematic for wallets (last activity 2025-10), #589 awardedDate mandatory, #613 bcrypt (2026-01) — all open in the "Future Version" backlog, no decisions. No OB 3.1 announced; 1EdTech maintains 3.0 Final via errata (v1.6, 2026-06-29 — absorbed), hence the context-drift watchdog.

• RFC 9864 fully-specified JOSE alg names (Ed25519 for EdDSA): adoption remains library-level; no major credential profile mandates it (HAIP stays ES256-centric). openvc-core ≥1.11 already accepts/emits it opt-in. Absorbed upstream — watch, no build.

• ML-DSA / post-quantum (new): RFC 9964 signatures ship experimental in openvc-core 1.19 ([pq] extra, cryptography≥48 on OpenSSL≥3.5). Zero badge demand today; the delegation pattern means adopting later is cheap. Watch.

• HAIP 1.1 — handed off to the dated EUDI December checkpoint (EUDI December checkpoint: SD-JWT VC RFC, HAIP 1.1 and the wallet deadline (2026-12) #248); the radar stops tracking it.

• quarterly check-in comment on this issue (next due ~2026-10, alongside the v4.0.0 release window); close it if it becomes noise

[luisgf]

Quarterly check-in (2026-07-17, round-3 analysis #249). Full refresh of the body above. Deltas since 2026-07-10: added Render Method / Confidence Method (2026 W3C recharter), the Data Integrity v1.1 maintenance drafts, and ML-DSA post-quantum (experimental in openvc-core); raised the signal on vc-di-bbs (1EdTech #640 proposes bbs-2023 as an allowed suite via errata — still CR Draft at W3C, still watch); handed off HAIP 1.1 to the dated December checkpoint #248; ELM/Europass and RFC 9864 unchanged. Also verified this quarter: OB3 errata v1.6 was absorbed by the watchdog exactly as designed. Next check-in ~2026-10.