Skip to content

M5-08 Verification Platform Integration (VerifyMyCreds / Velocity Verification Platform)

Milestone: M5 — Disclosure and Verification SOW Reference: FR3, INT4 Requirement Clarity: ✅ Resolved 2026-09-15 — VerifyMyCreds code reuse never held (DEP3, see M5-00); built as a direct CIH integration instead, confirmed working live Dev Status: ✅ Working — real end-to-end verification confirmed live 2026-09-15 (see update below)

Overview

Run verification on some or all disclosed credentials via an existing Velocity-enabled universal verification platform (VerifyMyCreds), reusing as much of VCL's existing code/functionality as licensing and technical compatibility allow.

Update 2026-09-15 — built, confirmed working live, not via VerifyMyCreds reuse

The "reuse VerifyMyCreds code" premise this task was blocked on never held — VerifyMyCreds is a closed hosted SaaS product with a non-sublicensable license (see M5-00's DEP3 finding). What actually got built instead: DisclosureService (app/backend/src/verification/services/disclosure.service.ts) integrates directly with Velocity's CIH Operator API (presentations/get, presentations/verify) via InspectorApiService — the "CV Capture" pattern from Velocity's own team, not VerifyMyCreds at all.

Confirmed working against real, live data 2026-09-15, after Velocity added Verification Vouchers to TESCO LLC's tenant (see M5-11): ran syncAndVerify() against Krishnaraj Velayutham's real disclosure (TESCO LLC, 12 disclosed credentials) —

status: "verified"
verificationStatus: "success"
12/12 credentials verified: true
All 6 checks passing on every credential (untampered, trusted issuer, trusted holder, unrevoked, unexpired, holder signature)

This is the first real, non-simulated, fully successful verification run since the milestone started.

Update, same day: the "Re-verify" button confirmed working through an actual browser session — clicked live, not simulated. Backend logs show a clean request lifecycle (real Auth0 JWT, getPresentation → 200, verifyPresentation → 200, no auth errors), and the DB reflects the same successful end state (status: verified, verificationStatus: success, 12/12 credential reports passing). The full path — HTTP route, JwtStrategy, RolesGuard, RelyingPartyCapabilityGuard, controller, service — is now confirmed working end to end, not just the underlying service method. Nothing outstanding on this task.

Backend Tasks

  • Get clarity from VCL/Curo on the exact reuse mechanism and what's provided vs. what needs building from scratch
  • Build a VerificationService (the verification module currently has zero controllers/providers — this is the first real code in it)
  • Implement calls to trigger verification and receive outcomes

Frontend Tasks

  • Build a "Run Verification" action from the candidate's disclosed-credentials view
  • Display verification outcome (feeds M5-09)

Dependencies

  • M5-07 wallet disclosure integration — verification runs against already-disclosed credentials.
  • Appendix 5, A10 — "Supplier may reuse existing Velocity/VCL components where permitted by licence and technical compatibility."

Acceptance Criteria

  • User can initiate verification
  • Verification platform integration succeeds
  • Verification outcome displayed (per SOW Appendix 3, FR3 acceptance criteria)

Existing Reference Material

Blockers & Risks

  • Needs decision: the reuse-code access question directly affects effort here — treat as a scoping question to raise alongside the M5-02/M5-11 open items.