[WAL-1346] feat(wallet): configure proximity reader trust

[szijpeter]

Summary

Closed as superseded — do not merge standalone. Its complete four-commit delta was transplanted into #2160 with 4/4 exact patch-equivalence proof. The Settings/public-file-import work also lands only in #2160.

Completes the application-configurable holder-side reader-trust policy for WAL-1346. Applications can now supply explicit Reader CA anchors, revocation policy, and optional RICAL providers through one immutable Kotlin/Swift configuration; the SDK still ships no universal trust list and never promotes reader-supplied certificates to trust anchors.

This PR is stacked on the three-demo proximity journey in walt-id/waltid-identity#2160. The governing architecture and trust boundary are documented in walt-id/waltid-architecture#60.

What Changed

Shared X.509 and RICAL validation

• Adds reusable ISO mdoc reader-authentication and RICAL-signer certificate profile validation, including explicit-anchor path building and time/profile checks.
• Validates signed RICAL material against application-selected provider roots, types, signer policy, freshness, constraints, and revocation behavior without implicit network access or trust.
• Keeps list signature validity, signer path, reader path, revocation, constraints, and final product trust as separate evidence.

Wallet SDK configuration

• Adds immutable Kotlin models for Reader CA anchors, reader revocation, RICAL providers, signer revocation, and ecosystem-specific constraint evaluation.
• Evaluates direct Reader CA and RICAL-derived trust through the existing shared reader-trust seam, with explicit trusted, unknown-authority, invalid, revoked, and indeterminate outcomes.
• Exposes the same semantics through Swift-native values and closures while keeping parsing and policy decisions in shared KMP code.

Contract and UI alignment

• Extends the KLIB ABI, Kotlin/Swift documentation, and focused shared/Swift tests for legal construction, path/profile failures, revocation, RICAL conflicts/unavailability, and trust outcomes.
• Adds the display-safe unknown-authority result to both demo renderers; the demos remain deliberately unconfigured unless an application supplies test or production trust material.

Architecture Notes

• Trust material and provider selection are application-owned. Reader-carried roots and intermediates are path inputs only.
• Revocation and RICAL retrieval are injected application boundaries; the SDK performs no hidden network requests.
• The immutable trust decision remains bound to the request preview, and platform UI code only renders the shared result.

Caveats and Follow-Ups

• This PR provides the policy and configuration surface; it does not provision production Reader CA or RICAL material for integrators.
• External-reader interoperability and release qualification remain owned by WAL-1349.
• NFC transport and demo integration continue in the stacked walt-id/waltid-identity#2165 and walt-id/waltid-identity#2166.

Breaking

No released API is broken. The mobile SDK is still unpublished, so the new trust configuration and exhaustive result state are introduced without migration aliases or compatibility shims.

[linear-code]

WAL-1346

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 29cd0ecd-3c6d-4b3d-b7c5-d16ae53d5140

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[szijpeter]

Superseded by #2160 at 893e42492c843ddb95eaca1a03bb34219583a8eb. The four donor commits were replayed 4/4 patch-equivalently (7a2ef2c69→5610ef0ed, 537a76579→b974424a6, 81744e9f3→e08e939b5, d1d35e5e0→d6cca7231), after which #2160 added the cross-platform Settings, validated public-file import, persistence, and immutable session snapshot. Closing without merge.