go/no-go: verify OpenID4VP / DC-API wallet presentations by delegating to openvc-core

[luisgf]

Horizon: mid (decision, not build) · Effort: S (decision) / M-L (build, delegated) · 2026-07-17 roadmap analysis (round 3)

The EU pull is real: every Member State must offer an EUDI Wallet by 2026-12-24, OIDF self-certification for OpenID4VP/OpenID4VCI/HAIP opened 2026-02, and Europass aligns with W3C VC — so badges will increasingly arrive at verifiers as wallet presentations, not as bare files. openvc-core ≥1.16 already verifies origin-bound vp_tokens over the W3C Digital Credentials API (1.17 adds mdoc) — the delegate half exists.

Following the #171 pattern (explicit go/no-go, delegation over native, opt-in extra):

• go/no-go: is "accept a badge presented from a wallet" (openbadgeslib on the RP/verifier side) in scope for this library, or is that the integrator's job on top of verify_badge?
• if go: a verify-only slice delegating to openvc-core (reusing the [eudi] extra), surfaced through the programmatic facade; no holder/wallet features
• build only on named demand (a deployment that actually receives wallet presentations)

OpenID4VCI issuance stays out regardless: openvc-core has none as of 1.20.2, and issuing into wallets is a different bet. Input due from the December EUDI checkpoint (cross-referenced from that issue).