Explicitly define which (part of) sections apply to which profile

[martijnharing]

Section 3 defines profiles, but doesn't say explicitly which parts of HAIP must be implemented to be compliant to that profile. For each profile specified in HAIP, we should explicitly say which section apply and which do not.

For example for section 9 and 10.1 it's not explicit to what extent they are applicable to each profile.

[Sakurann]

i believe this should be addressed by #228, cc @awoie

[Sakurann]

wg discussion:

• there is no such things as "haip compliant", but there is such a thing that compliant to one or more of the flows (VP without dc api, VP with dc api, or VCI) with one of the credential formats (sd-jwt vc or mdoc) defined in HAIP.

below are a bit of playing with words.

we have below sentence in HAIP:

Implementations of this specification do not have to implement all of the flows listed above, but they MUST be compliant to all of the requirements for a particular flow they chose to implement.

we could clarify things with credential formats:

Implementations of this specification do not have to implement all of the flows listed above and both of the credential formats, but they MUST be compliant to all of the requirements for a particular flow and a credential format that they chose to implement.

would this address the concern?

[martijnharing]

The current text says:

"This specification enables interoperable implementations of the following flows:

-Issuance using OpenID4VCI for IETF SD-JWT VC and ISO mdocs
-Presentation using OpenID4VP via redirects or the W3C Digital Credentials API for IETF SD-JWT VC and ISO mdocs
-OpenID4VC Credential Format Profiles"

Even with the additional proposed text, it's not clear what exactly you need to implement to be compliant with "OpenID4VC credential format profiles" If the intention is to define whether a VC is compliant or not with HAIP, irrespective of how it's used, then the term 'flow' isn't really appropriate.
Another example where it's currently not clear is whether the requirements are section 6, 6.1 etc are applicable when doing issuance or presentment, since neither of the openid4vp or the openid4vci sections refer to section 6 and there is a separate flow that does seem to refer to section 6 exclusively.

One possible way would be to list all the different flows and define which sections you have to implement to be compliant with that flow. For example:

• Presentation using OpenID4VP via redirects for IETF SD-JWT VC, requires compliance with sections 5, 5.1, 5.3.2, 6, 6.1 6.1.1 and 6.1.1.1
• Presentation using OpenID4VP via redirects for mdoc, requires compliance with sections 5, 5.2, 5.3.1
• etc

Then separately have a statement that for all flows you must implement 7, 8, 9 and 10.