YM-OpenClaw

Tracks the identity-attestation reconciliation and generic "id" naming work. Related to #3826.

Scope¶

• ym-openclaw plugin: align identity-v1 attestation with the IDP; fail loudly when identity attestation is requested but unfulfillable; rename Credential Vault -> Identity Vault; document the browser-integration gap (no plugin page-script hook in OpenClaw SDK); rename the identity claim email/phone -> generic "id".
• ym-website2: reconcile the IDP and website simplewebauthn verifiers into a byte-identical superset (legacy 5-seg HMAC + 6-seg ymid IBS + transitional attStmt identity-v1); rename pairing payload email -> id; name the ymid identity claim generically as "id" on the IDP.

Key decision¶

Website keeps "phone" (phone is the id there today); IDP + mobile use the generic "id" name to prepare for other id types. Value stays the phone for now; wire string unchanged.

Branches¶

• ym-openclaw: merged to main (fix-identity-attestation-alignment).
• ym-website2: reconcile-identity-attestation merged to master; idp-id-naming pending review.