Define Credential — credential library beyond age/membership/payment (defineCredential extension)

[dzuluaga]

Owner: Ever. Captured from the 2026-06-30 planning chat — this is the background + scope so Ever can turn it into a Speckit spec (spec-only PR → Diego review → impl).

What it is

The defineCredential() extension point — gate ANY consequential action with ANY credential (constitution Principle V). The three built-ins (age / membership / payment) are just pre-defined credentials; you write your own the same way, passed by object, no registration step.

Already ships in v0.1 (the baseline — don't rebuild)

• API: defineCredential({ id, request, verify, effect, ui }), composed on the same ordered policy array as the built-ins.
• Effects: gate() | discount() | authorize().
• Conditionality: appliesTo (AND-ed with any call-site .when()) — a credential surfaces only when relevant.
• Worked example: a prescription gate, defined inline, conditional to pharmacy lines → examples/custom-credential.mjs.
• Request speaks DCQL (dcql); verify against mdoc / OpenID4VP → ceremony/credential-gate/{request,verify,dcql,mdoc-verify}.ts.

The v0.2 gap (what this issue adds)

Per ROADMAP.md (v0.2): "a credential library beyond the worked example" — real-world packs expressible as an mdoc / SD-JWT claim (e.g. military, employer/company, passport, healthcare, residency, license, education). Make adding a new credential type a clean, documented, tested path.

Scope to define (for the spec)

• Which packs ship first, and each one's DCQL request shape + verify logic (mdoc vs SD-JWT).
• DX: is defineCredential() ergonomic enough, or does a pack need a thin helper?
• Test-credential dependency: verifying a new credential needs test credentials to present — ties to wallet/issuer interop + a dev test-issuer (no GH issue yet — flag it).
• Honesty: each pack carries the right trust_level (presence-only-demo until issuer-verified lands, Issuer-verified trust anchor — real KB-JWT / mdoc issuer+device signatures (v0.3) #14).

Prior context (so you don't start from zero)

• Constitution Principle V — .specify/memory/constitution.md (+ specs/001-attesto-sdk/).
• examples/custom-credential.mjs (the prescription worked example).
• The credential-gate module — ceremony/credential-gate/.