davidherranandClaude Fable 5
114721c24a
Audit ultra 2026-07-04 (dimensión ink-contracts, decisión C de David): un issuer malicioso podía emitir credenciales ilimitadas a una VÍCTIMA, bloateando su holder_credentials: Vec hasta que cualquier op que lo cargara (issue/read) excedía el gas → griefing DoS. Fix: MAX_CREDENTIALS_PER_HOLDER=512 + error HolderCredentialLimitReached antes del push. (Nota: el índice issuer_credentials de un emisor de alto volumen debe migrar a Mapping<(issuer,i),id> paginado — trabajo futuro; no es griefing de terceros.) Contrato 4 tests verde. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
origin-credential-mint — Cryptographic Credentials Template (Slice 3.4)
Third foundational template del Origin Contract Atelier. Ed25519 + BLAKE3 academic/professional/KYB credentials. Sussi Ethos schema integration.
Use cases
| Use case | Issuer | Holder |
|---|---|---|
| Diploma universitario | UCLA / Universidad | Estudiante |
| Professional cert (PMP, AWS) | Certification body | Profesional |
| Sussi Ethos KYB Nivel 3+ | Oracle Pillar 6 | Institución |
| Atelier skill mastery | Marihan Atelier | Originner student |
| Origin Wallet identity | Foundation Oracle | Originner ciudadano |
CredentialType enum (5 variants)
- Academic: diplomas, transcripts, university credentials
- Professional: industry certifications (PMP, AWS, Microsoft, etc.)
- Kyb: Sussi Ethos Oracle KYB institutional verification
- Skill: Marihan Atelier skill mastery post-Meta Entorno completion
- Custom: user-defined schema extension
Schema canonical (Sussi Ethos integration pending)
Each credential = (issuer + holder + schema_type + data_hash + signature + dates):
- data_hash: BLAKE3 del JSON-LD credential data (off-chain Hypercore storage)
- issuer_signature: Ed25519 sobre
(holder + schema_type + data_hash + issued_at + expires_at) - expires_at: Optional canonical (None = perpetua, Some(N) = expires at block N)
On-chain verification de Ed25519 signature pending Phase 3.x — currently signature stored para off-chain verification via sp_io::crypto::ed25519_verify host function precompile.
Inmutables compliance
- #16 HTS anti-clasista: issue_fee modulated HardwareTier para escuelas Pi 5 rurales
- #26 Content-Addressed: data_hash BLAKE3 + signature Ed25519 inmutables post-mint
- #37 Free perpetua: verify() + queries free siempre
- #41 AGI Cross-Species: AGI puede issuer (Daimonion attests skills) OR holder
Cross-pillar coord
- Sussi Pillar 6 (Ethos Oracle): KYB issuer canonical authorized via governance
- Marihan Atelier: skill mastery credentials post-completion
- Charon Pillar 4: deploy + storage on Origin Chain
Tests (3 unit tests)
constructor_canonical— initial stateunauthorized_issuer_rejected— whitelist enforcementcredential_type_serialization— all variants encode/decode
— Charon ⚓ (Slice 3.4 SCAFFOLD 2026-05-27)