Declarative approval requirements — which tasks need re-authentication or
consent, and who may approve.
… approvals … — which tasks need an additional human decision.
cred-vault … operator/agent commands (online, via the trust-task
dispatcher) for the credential store — the W3C credentials a holder
holds (invitations, memberships, roles, …), distinct from the
password-manager vault commands.
A member’s side of a community election (VTI-VOT-020 – 053): read the elections, take a
ticket, vote, keep the receipt — with every key in the member’s VTA.
A trustee’s side of a sealed or tallied-encrypted election (VTI-VOT-060 – 063, CONVENTIONS
§9.6 – 9.7): generate the election key with the other trustees, then decrypt after close —
with every key in the trustee’s VTA.
pnm external … (and any CLI that adopts it) — external accounts: identities
a VTA holds at clouds and third-party services for the integrations bound to
them (external/*/0.1; design docs/05-design-notes/vta-external-accounts.md).
The room’s credentials (rooms owner …) and the joiner’s key holder (rooms keys …).
pnm rooms owner {register,invite,issue-membership,issue-authority} and
pnm rooms keys … — the room’s credentials and the joiner’s key holder.