Make check ids required, and rename SuiteSummary.verified to hasFailures

CHANGELOG.md

@@ -14,9 +14,21 @@ not run after a fatal failure.
   `@interop/ecdsa-multikey`. `defaultCryptoSuites()` now registers three suites:
   Ed25519Signature2020, EdDSA RDFC-2022, and ECDSA RDFC-2019.
 - `SuiteSummary` type and `summary: SuiteSummary[]` field on
-  `CredentialVerificationResult` and `PresentationVerificationResult`.
-- `id: string` field on `CheckResult` — dot-separated
-  `<phase>.<suite>.<localPart>` namespace.
+  `CredentialVerificationResult` and `PresentationVerificationResult`. A
+  summary has no `verified` field: the only verdict is the result-level
+  `verified` ("no fatal check failed"). `status` comes from the suite's
+  counts, so a non-fatal failure shows as `status: 'failure'` or `'mixed'`
+  inside a result that is still `verified: true`. The one suite whose check
+  failed fatally carries `fatalFailureAt`, and a result is unverified exactly
+  when one of its summaries has it; UIs should colour that suite as an error
+  and other failing suites as warnings.
+- Required `id: string` field on `CheckResult` — dot-separated
+  `<phase>.<suite>.<localPart>` namespace, set by the suite runner on every
+  row it emits (including not-run rows and synthetic `<suite>.applies`
+  rows), and by the parse-failure path on its one row. A suite with no
+  `phase` produces ids beginning `unknown.`. Check ids and the built-in
+  suites' phase tags are fixed for 2.x; since an id embeds its suite's
+  phase, changing either is a breaking change.
 - Pure `foldCheckResults` helper and `computeId` namespace builder, both
   exported from the package barrel.
 - New consumer doc at `docs/api/verification-results.md` covering the result
@@ -224,8 +236,10 @@ not run after a fatal failure.
 
 ### Deprecated
 
-- `CheckResult.check` and `CheckResult.suite` — use `CheckResult.id` instead.
-  Removal target: the next major.
+- `CheckResult.check` — use `CheckResult.id` instead. Removal target: the
+  next major. `CheckResult.suite` is **not** deprecated: it is how rows are
+  grouped, it matches `SuiteSummary.suite`, and it cannot be recovered from
+  `id`, because a suite id may itself contain dots.
 
 ### Removed
 
@@ -240,7 +254,7 @@ not run after a fatal failure.
 
 - To adopt the new shape: read `result.summary[]` for the per-suite rollup; read
   `result.results[]` for per-check detail; use
-  `r.id?.startsWith(summary.id + '.')` to find the detail rows under a summary
+  `r.id.startsWith(summary.id + '.')` to find the detail rows under a summary
   entry, narrowing by `r.outcome.status` when you want only the failures.
 - **Registry matches.** 1.x returned the registry's record of the issuer at the
   top level of the verification result, as `matchingIssuers[]`, each

README.md

@@ -811,19 +811,23 @@ a `summary: SuiteSummary[]` rollup of per-suite outcomes alongside the full
 
 ```ts
 const result = await verifier.verifyCredential({ credential });
-// result.summary[i] = { id, phase, suite, status, verified, message, counts, ... }
+// result.summary[i] = { id, phase, suite, status, message, counts, fatalFailureAt?, ... }
 // result.results[]  = every check that ran, was skipped, or was not run,
-//                     each with .id populated
+//                     each with its .id
 
 // Detail rows for one summary entry — filter by status for just the failures.
 const failures = result.results.filter(
-  r => r.id?.startsWith(result.summary[0].id + '.') &&
+  r => r.id.startsWith(result.summary[0].id + '.') &&
        r.outcome.status === 'failure'
 );
 ```
 
 Render from `summary[]` and lazy-expand into `results[]`.
 
+Check ids and the built-in suites' `phase` tags are fixed for 2.x. An id
+embeds its suite's phase, so re-tagging a built-in suite would rename every
+check in it: changing either is a breaking change.
+
 See [`docs/api/verification-results.md`](./docs/api/verification-results.md) for
 the full reference (phase model, `SuiteSummary` fields, `id` namespace, UI
 rendering recipe, and a prompt-ready appendix for downstream UIs).

docs/api/timing.md

@@ -310,7 +310,7 @@ function buildBreakdown(result: PresentationVerificationResult) {
       bySuite: cr.summary.map(s => ({
         suite: s.id,
         durationMs: s.timing!.durationMs,
-        verified: s.verified,
+        fatalFailureAt: s.fatalFailureAt,
       })),
     })),
   };