From 0dd1ac96f0989060adab6886edcec031192e2953 Mon Sep 17 00:00:00 2001
From: coodos <me@merul.org>
Date: Tue, 10 Mar 2026 21:16:49 +0530
Subject: [PATCH 1/4] feat: relation description and fixes to social connection

---
 docs/docs/W3DS Basics/Binding-Documents.md    | 10 ++++++--
 .../gen/android/key-shitore.properties        |  3 +++
 .../eid-wallet/src/lib/utils/socialBinding.ts |  9 +++++++-
 .../src/routes/(app)/ePassport/+page.svelte   |  8 +++++++
 .../src/routes/(app)/scan-qr/+page.svelte     |  3 +++
 .../components/SocialBindingDrawer.svelte     | 19 +++++++++++++++
 .../src/routes/(app)/scan-qr/scanLogic.ts     | 10 ++++++++
 .../src/core/types/binding-document.ts        |  2 ++
 .../services/BindingDocumentService.spec.ts   |  8 ++++---
 .../src/services/BindingDocumentService.ts    | 23 ++++++++++++++++++-
 .../ontology/schemas/binding-document.json    | 13 ++++++++++-
 11 files changed, 100 insertions(+), 8 deletions(-)
 create mode 100644 infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties

diff --git a/docs/docs/W3DS Basics/Binding-Documents.md b/docs/docs/W3DS Basics/Binding-Documents.md
index 3488f4c66..b33b55efb 100644
--- a/docs/docs/W3DS Basics/Binding-Documents.md	
+++ b/docs/docs/W3DS Basics/Binding-Documents.md	
@@ -74,19 +74,25 @@ Binds an eName to a photograph (selfie or profile picture).
 
 ### social_connection
 
-Binds an eName to a social connection or relationship claim.
+Binds an eName to a social connection or relationship claim between two parties.
 
 ```json
 {
   "type": "social_connection",
   "data": {
-    "name": "Alice Smith"
+    "kind": "social_connection",
+    "name": "Alice Smith",
+    "parties": ["@ename-1", "@ename-2"],
+    "relation_description": "Known each other since university"
   }
 }
 ```
 
 **Data fields:**
+- `kind` — Discriminant field, always `"social_connection"`
 - `name` — Name of the connected person or entity
+- `parties` — Array of exactly two eNames identifying both participants in the connection
+- `relation_description` — Arbitrary text describing the nature of the relationship
 
 ### self
 
diff --git a/infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties b/infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties
new file mode 100644
index 000000000..7ebcd924e
--- /dev/null
+++ b/infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties
@@ -0,0 +1,3 @@
+password=$th3r3a1m3ru1
+keyAlias=key0
+storeFile=/home/merul/Stuff/msf-android-keys/Untitled
diff --git a/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts b/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
index 9a5924575..fa84bc91f 100644
--- a/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
+++ b/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
@@ -296,6 +296,8 @@ export async function createSocialConnectionDoc(
     subject: string,
     subjectName: string,
     signatureHash: string,
+    parties: [string, string],
+    relationDescription: string,
 ): Promise<string> {
     const normalizedSubject = subject.startsWith("@") ? subject : `@${subject}`;
     const normalizedSigner = signerEname.startsWith("@")
@@ -310,7 +312,12 @@ export async function createSocialConnectionDoc(
             input: {
                 subject: normalizedSubject,
                 type: "social_connection",
-                data: { kind: "social_connection", name: subjectName },
+                data: {
+                    kind: "social_connection",
+                    name: subjectName,
+                    parties,
+                    relation_description: relationDescription,
+                },
                 ownerSignature: {
                     signer: normalizedSigner,
                     signature: signatureHash,
diff --git a/infrastructure/eid-wallet/src/routes/(app)/ePassport/+page.svelte b/infrastructure/eid-wallet/src/routes/(app)/ePassport/+page.svelte
index 8af5076bf..25405704b 100644
--- a/infrastructure/eid-wallet/src/routes/(app)/ePassport/+page.svelte
+++ b/infrastructure/eid-wallet/src/routes/(app)/ePassport/+page.svelte
@@ -733,6 +733,14 @@ onMount(async () => {
                     </p>
                 {/if}
             </div>
+            {#if socialBindingPendingDocParsed?.data?.relation_description}
+                <div class="bg-gray rounded-2xl p-4 flex flex-col gap-1">
+                    <p class="small text-black-500">Relationship Description</p>
+                    <p class="text-sm text-black-700">
+                        {socialBindingPendingDocParsed.data.relation_description}
+                    </p>
+                </div>
+            {/if}
             {#if socialBindingError}
                 <p class="text-danger">{socialBindingError}</p>
             {/if}
diff --git a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/+page.svelte b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/+page.svelte
index 9645be565..8344ce7b8 100644
--- a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/+page.svelte
+++ b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/+page.svelte
@@ -49,6 +49,7 @@ const {
     socialBindingLoading,
     socialBindingError,
     socialBindingSuccess,
+    socialBindingRelationDescription,
 } = stores;
 
 const {
@@ -266,9 +267,11 @@ function handleSocialBindingOpenChange(value: boolean) {
     loading={$socialBindingLoading}
     error={$socialBindingError}
     success={$socialBindingSuccess}
+    relationDescription={$socialBindingRelationDescription}
     onConfirm={handleSocialBindingConfirm}
     onDecline={handleSocialBindingDecline}
     onOpenChange={handleSocialBindingOpenChange}
+    onDescriptionChange={(value) => socialBindingRelationDescription.set(value)}
 />
 
 <style>
diff --git a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/components/SocialBindingDrawer.svelte b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/components/SocialBindingDrawer.svelte
index 4ebbe814b..03de902cf 100644
--- a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/components/SocialBindingDrawer.svelte
+++ b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/components/SocialBindingDrawer.svelte
@@ -10,9 +10,11 @@ export let requesterName: string | null;
 export let loading: boolean;
 export let error: string | null;
 export let success: boolean;
+export let relationDescription: string;
 export let onConfirm: () => void;
 export let onDecline: () => void;
 export let onOpenChange: (value: boolean) => void;
+export let onDescriptionChange: (value: string) => void;
 
 let internalOpen = isOpen;
 let lastReportedOpen = internalOpen;
@@ -123,6 +125,23 @@ $: displayName = requesterName ?? requesterEname ?? "Unknown";
                         </table>
                     </div>
 
+                    <div class="w-full mt-4">
+                        <label
+                            for="relation-description"
+                            class="text-xs font-semibold text-black-500 uppercase tracking-wider block mb-1"
+                        >
+                            Relationship Description
+                        </label>
+                        <textarea
+                            id="relation-description"
+                            class="w-full rounded-xl border border-gray-200 bg-gray-50 p-3 text-sm text-black-700 resize-none focus:outline-none focus:border-primary"
+                            rows="3"
+                            placeholder="Describe how you know this person..."
+                            value={relationDescription}
+                            oninput={(e) => onDescriptionChange(e.currentTarget.value)}
+                        ></textarea>
+                    </div>
+
                     {#if error}
                         <div
                             class="bg-red-50 border border-red-200 rounded-lg p-4 mt-4 w-full text-sm text-red-700"
diff --git a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
index b06a57caf..ce0fb3bdd 100644
--- a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
+++ b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
@@ -95,6 +95,7 @@ interface ScanStores {
     socialBindingLoading: Writable<boolean>;
     socialBindingError: Writable<string | null>;
     socialBindingSuccess: Writable<boolean>;
+    socialBindingRelationDescription: Writable<string>;
 }
 
 interface ScanActions {
@@ -172,6 +173,7 @@ export function createScanLogic({
     const socialBindingLoading = writable(false);
     const socialBindingError = writable<string | null>(null);
     const socialBindingSuccess = writable(false);
+    const socialBindingRelationDescription = writable("");
 
     let permissionsNullable: PermissionState | null = null;
 
@@ -707,12 +709,16 @@ export function createScanLogic({
             // Single write: signer creates the doc in the REQUESTER's vault.
             // subject=@requester, data.name=requesterName, ownerSig=@signer.
             // The requester polls their own vault, finds it, and counter-signs it there.
+            const parties: [string, string] = [signerEname, normalizedRequesterEname];
+            const relationDescription = get(socialBindingRelationDescription);
             const doc = {
                 subject: requesterEname,
                 type: "social_connection",
                 data: {
                     kind: "social_connection",
                     name: requesterName,
+                    parties,
+                    relation_description: relationDescription,
                 } as Record<string, unknown>,
             };
             const payload = getCanonicalBindingDocString(doc);
@@ -729,6 +735,8 @@ export function createScanLogic({
                 requesterEname,
                 requesterName,
                 sig,
+                parties,
+                relationDescription,
             );
 
             socialBindingSuccess.set(true);
@@ -750,6 +758,7 @@ export function createScanLogic({
         socialBindingRequesterName.set(null);
         socialBindingError.set(null);
         socialBindingSuccess.set(false);
+        socialBindingRelationDescription.set("");
         socialBindingLoading.set(false);
     }
 
@@ -1610,6 +1619,7 @@ export function createScanLogic({
             socialBindingLoading,
             socialBindingError,
             socialBindingSuccess,
+            socialBindingRelationDescription,
         },
         actions: {
             startScan,
diff --git a/infrastructure/evault-core/src/core/types/binding-document.ts b/infrastructure/evault-core/src/core/types/binding-document.ts
index beec5ed58..98da829d1 100644
--- a/infrastructure/evault-core/src/core/types/binding-document.ts
+++ b/infrastructure/evault-core/src/core/types/binding-document.ts
@@ -23,6 +23,8 @@ export interface BindingDocumentPhotographData {
 export interface BindingDocumentSocialConnectionData {
     kind: "social_connection";
     name: string;
+    parties: [string, string];
+    relation_description: string;
 }
 
 export interface BindingDocumentSelfData {
diff --git a/infrastructure/evault-core/src/services/BindingDocumentService.spec.ts b/infrastructure/evault-core/src/services/BindingDocumentService.spec.ts
index 4f10cdb3b..bf32ee6b9 100644
--- a/infrastructure/evault-core/src/services/BindingDocumentService.spec.ts
+++ b/infrastructure/evault-core/src/services/BindingDocumentService.spec.ts
@@ -92,7 +92,7 @@ describe("BindingDocumentService (integration)", () => {
         });
 
         it("should create a binding document with social_connection type", async () => {
-            const data = { kind: "social_connection" as const, name: "Alice Smith" };
+            const data = { kind: "social_connection" as const, name: "Alice Smith", parties: ["@signer", "@test-user-123"] as [string, string], relation_description: "Friend from work" };
             const result = await bindingDocumentService.createBindingDocument(
                 {
                     subject: "test-user-123",
@@ -111,6 +111,8 @@ describe("BindingDocumentService (integration)", () => {
             expect(result.bindingDocument.data).toEqual({
                 kind: "social_connection",
                 name: "Alice Smith",
+                parties: ["@signer", "@test-user-123"],
+                relation_description: "Friend from work",
             });
         });
 
@@ -317,7 +319,7 @@ describe("BindingDocumentService (integration)", () => {
         });
 
         it("should reject when the same signer attempts to sign twice", async () => {
-            const data = { kind: "social_connection" as const, name: "Duplicate Signer Test" };
+            const data = { kind: "social_connection" as const, name: "Duplicate Signer Test", parties: ["@signer", "@counterparty"] as [string, string], relation_description: "Test" };
             const subject = "@counterparty";
             const docHash = computeBindingDocumentHash({ subject, type: "social_connection", data });
             const created = await bindingDocumentService.createBindingDocument(
@@ -382,7 +384,7 @@ describe("BindingDocumentService (integration)", () => {
         it("should have an audit log entry after adding a counterparty signature", async () => {
             // For social_connection, the counterparty signer must equal the document's subject
             const counterpartyEName = "@test-user-countersign-audit";
-            const data = { kind: "social_connection" as const, name: "CounterSign Audit" };
+            const data = { kind: "social_connection" as const, name: "CounterSign Audit", parties: ["@signer", "@test-user-countersign-audit"] as [string, string], relation_description: "Audit test" };
             const docHash = computeBindingDocumentHash({ subject: counterpartyEName, type: "social_connection", data });
             const created = await bindingDocumentService.createBindingDocument(
                 {
diff --git a/infrastructure/evault-core/src/services/BindingDocumentService.ts b/infrastructure/evault-core/src/services/BindingDocumentService.ts
index f0ab0724b..e0f84cda7 100644
--- a/infrastructure/evault-core/src/services/BindingDocumentService.ts
+++ b/infrastructure/evault-core/src/services/BindingDocumentService.ts
@@ -63,7 +63,28 @@ function validateBindingDocumentData(
                     'social_connection data must have string field: name',
                 );
             }
-            return { kind: "social_connection", name: d.name } as BindingDocumentSocialConnectionData;
+            if (
+                !Array.isArray(d.parties) ||
+                d.parties.length !== 2 ||
+                !d.parties.every(
+                    (p: unknown) => typeof p === "string" && (p as string).startsWith("@"),
+                )
+            ) {
+                throw new ValidationError(
+                    'social_connection data must have parties: array of 2 eNames prefixed with @',
+                );
+            }
+            if (typeof d.relation_description !== "string") {
+                throw new ValidationError(
+                    'social_connection data must have string field: relation_description',
+                );
+            }
+            return {
+                kind: "social_connection",
+                name: d.name,
+                parties: d.parties as [string, string],
+                relation_description: d.relation_description as string,
+            } as BindingDocumentSocialConnectionData;
         }
         case "self": {
             if (typeof d.name !== "string") {
diff --git a/services/ontology/schemas/binding-document.json b/services/ontology/schemas/binding-document.json
index 919f171da..5450b6001 100644
--- a/services/ontology/schemas/binding-document.json
+++ b/services/ontology/schemas/binding-document.json
@@ -105,9 +105,20 @@
                 "name": {
                     "type": "string",
                     "description": "Name of the social connection"
+                },
+                "parties": {
+                    "type": "array",
+                    "items": { "type": "string" },
+                    "minItems": 2,
+                    "maxItems": 2,
+                    "description": "eNames of both participants"
+                },
+                "relation_description": {
+                    "type": "string",
+                    "description": "Arbitrary text describing the relationship"
                 }
             },
-            "required": ["kind", "name"],
+            "required": ["kind", "name", "parties", "relation_description"],
             "additionalProperties": false
         },
         "SelfData": {

From 58c5b524e4caad0a97fb0ba67e900871f4d13e98 Mon Sep 17 00:00:00 2001
From: coodos <me@merul.org>
Date: Tue, 10 Mar 2026 21:23:26 +0530
Subject: [PATCH 2/4] chore: format

---
 infrastructure/control-panel/README.md           |  2 +-
 .../control-panel/config/admin-enames.json       | 12 ++++++------
 .../src/lib/services/evaultService.ts            |  1 -
 .../src/lib/services/notificationService.ts      | 15 ++++++++-------
 .../control-panel/src/routes/+layout.svelte      | 16 +++++++++++-----
 .../control-panel/src/routes/+page.svelte        |  3 +--
 .../control-panel/src/routes/api/auth/+server.ts | 14 +++++++-------
 .../src/routes/api/evaults/+server.ts            | 11 +++++++----
 .../api/notifications/send-bulk-all/+server.ts   |  5 +----
 .../api/notifications/send-bulk/+server.ts       |  5 ++++-
 .../api/notifications/send-by-ename/+server.ts   | 10 ++--------
 .../control-panel/src/routes/login/+page.svelte  | 10 +++++++---
 .../src/routes/monitoring/+page.svelte           |  4 +++-
 .../src/routes/notifications/+page.svelte        |  4 +++-
 .../src/routes/(app)/scan-qr/scanLogic.ts        |  5 ++++-
 15 files changed, 65 insertions(+), 52 deletions(-)

diff --git a/infrastructure/control-panel/README.md b/infrastructure/control-panel/README.md
index 519daf30a..0a05758ae 100644
--- a/infrastructure/control-panel/README.md
+++ b/infrastructure/control-panel/README.md
@@ -129,7 +129,7 @@ CONTROL_PANEL_ADMIN_ENAMES_FILE=config/admin-enames.json
 
 ```json
 {
-  "admins": ["@admin1.w3id", "@admin2.w3id"]
+	"admins": ["@admin1.w3id", "@admin2.w3id"]
 }
 ```
 
diff --git a/infrastructure/control-panel/config/admin-enames.json b/infrastructure/control-panel/config/admin-enames.json
index 94091aa01..5bc4d31c8 100644
--- a/infrastructure/control-panel/config/admin-enames.json
+++ b/infrastructure/control-panel/config/admin-enames.json
@@ -1,8 +1,8 @@
 {
-    "admins": [
-        "@7218b67d-da21-54d6-9a85-7c4db1d09768",
-        "@82f7a77a-f03a-52aa-88fc-1b1e488ad498",
-        "@35a31f0d-dd76-5780-b383-29f219fcae99",
-        "@82f7a77a-f03a-52aa-88fc-1b1e488ad498"
-    ]
+	"admins": [
+		"@7218b67d-da21-54d6-9a85-7c4db1d09768",
+		"@82f7a77a-f03a-52aa-88fc-1b1e488ad498",
+		"@35a31f0d-dd76-5780-b383-29f219fcae99",
+		"@82f7a77a-f03a-52aa-88fc-1b1e488ad498"
+	]
 }
diff --git a/infrastructure/control-panel/src/lib/services/evaultService.ts b/infrastructure/control-panel/src/lib/services/evaultService.ts
index 8efa1d038..4c1f00118 100644
--- a/infrastructure/control-panel/src/lib/services/evaultService.ts
+++ b/infrastructure/control-panel/src/lib/services/evaultService.ts
@@ -30,7 +30,6 @@ export class EVaultService {
 		return freshData;
 	}
 
-
 	/**
 	 * Get cache status information
 	 */
diff --git a/infrastructure/control-panel/src/lib/services/notificationService.ts b/infrastructure/control-panel/src/lib/services/notificationService.ts
index cfad78ab3..02b7bbe76 100644
--- a/infrastructure/control-panel/src/lib/services/notificationService.ts
+++ b/infrastructure/control-panel/src/lib/services/notificationService.ts
@@ -28,9 +28,7 @@ function getBaseUrl(): string {
 	return `http://localhost:${port}`;
 }
 
-export async function sendNotification(
-	request: SendNotificationRequest
-): Promise<SendResult> {
+export async function sendNotification(request: SendNotificationRequest): Promise<SendResult> {
 	const baseUrl = getBaseUrl();
 	try {
 		const response = await fetch(`${baseUrl}/api/send`, {
@@ -69,9 +67,9 @@ export async function getDevicesWithTokens(): Promise<
 	}
 }
 
-export async function getDevicesByEName(eName: string): Promise<
-	{ token: string; platform: string; eName: string }[]
-> {
+export async function getDevicesByEName(
+	eName: string
+): Promise<{ token: string; platform: string; eName: string }[]> {
 	const { env } = await import('$env/dynamic/private');
 	const provisionerUrl =
 		env.PUBLIC_PROVISIONER_URL || env.PROVISIONER_URL || 'http://localhost:3001';
@@ -110,7 +108,10 @@ export async function sendBulkNotifications(
 	return {
 		sent,
 		failed: failed.length,
-		errors: failed.map((r) => ({ token: r.token.slice(0, 20) + '...', error: r.error ?? 'Unknown' }))
+		errors: failed.map((r) => ({
+			token: r.token.slice(0, 20) + '...',
+			error: r.error ?? 'Unknown'
+		}))
 	};
 }
 
diff --git a/infrastructure/control-panel/src/routes/+layout.svelte b/infrastructure/control-panel/src/routes/+layout.svelte
index 5a51b9e84..b666e277b 100644
--- a/infrastructure/control-panel/src/routes/+layout.svelte
+++ b/infrastructure/control-panel/src/routes/+layout.svelte
@@ -27,7 +27,7 @@
 
 {#if isLoginRoute}
 	<main class="min-h-screen bg-gray-50">
-		<section class="px-10 pb-10 pt-10">
+		<section class="px-10 pt-10 pb-10">
 			{@render children()}
 		</section>
 	</main>
@@ -104,7 +104,8 @@
 											const evaultObjects = evaultIds
 												.map((id: string) =>
 													allEVaults.find(
-														(e: any) => (e.evault || e.ename || e.id) === id
+														(e: any) =>
+															(e.evault || e.ename || e.id) === id
 													)
 												)
 												.filter(Boolean);
@@ -125,7 +126,8 @@
 										) {
 											const { registryService } =
 												await import('$lib/services/registry');
-											const allPlatforms = await registryService.getPlatforms();
+											const allPlatforms =
+												await registryService.getPlatforms();
 											const platformObjects = platformUrls
 												.map((url: string) =>
 													allPlatforms.find((p: any) => p.url === url)
@@ -155,11 +157,15 @@
 					{/if}
 
 					{#if data?.user?.ename}
-						<div class="rounded-full border border-gray-200 bg-gray-50 px-3 py-1 text-sm text-gray-700">
+						<div
+							class="rounded-full border border-gray-200 bg-gray-50 px-3 py-1 text-sm text-gray-700"
+						>
 							{data.user.ename}
 						</div>
 					{/if}
-					<ButtonAction size="sm" variant="soft" callback={handleLogout}>Logout</ButtonAction>
+					<ButtonAction size="sm" variant="soft" callback={handleLogout}
+						>Logout</ButtonAction
+					>
 				</div>
 			</header>
 			<section class="px-10 pb-10">
diff --git a/infrastructure/control-panel/src/routes/+page.svelte b/infrastructure/control-panel/src/routes/+page.svelte
index 66d0860da..1ed9b1885 100644
--- a/infrastructure/control-panel/src/routes/+page.svelte
+++ b/infrastructure/control-panel/src/routes/+page.svelte
@@ -463,8 +463,7 @@
 </script>
 
 {#snippet ENameWithType(value: unknown)}
-	{@const item =
-		(value as { ename?: string; type?: 'user' | 'group' } | null) ?? null}
+	{@const item = (value as { ename?: string; type?: 'user' | 'group' } | null) ?? null}
 	{@const ename = item?.ename || 'N/A'}
 	{@const type = item?.type || 'group'}
 	<div class="flex items-center gap-2 whitespace-nowrap">
diff --git a/infrastructure/control-panel/src/routes/api/auth/+server.ts b/infrastructure/control-panel/src/routes/api/auth/+server.ts
index 589a8d424..b694486e9 100644
--- a/infrastructure/control-panel/src/routes/api/auth/+server.ts
+++ b/infrastructure/control-panel/src/routes/api/auth/+server.ts
@@ -19,13 +19,10 @@ type VerifySignatureOutput = {
 };
 
 const require = createRequire(import.meta.url);
-let verifySignatureFn:
-	| ((options: VerifySignatureInput) => Promise<VerifySignatureOutput>)
-	| null = null;
+let verifySignatureFn: ((options: VerifySignatureInput) => Promise<VerifySignatureOutput>) | null =
+	null;
 
-async function verifyW3dsSignature(
-	options: VerifySignatureInput
-): Promise<VerifySignatureOutput> {
+async function verifyW3dsSignature(options: VerifySignatureInput): Promise<VerifySignatureOutput> {
 	if (!verifySignatureFn) {
 		const signatureValidator = require('signature-validator') as {
 			verifySignature: (input: VerifySignatureInput) => Promise<VerifySignatureOutput>;
@@ -82,7 +79,10 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
 		const registryBaseUrl = env.PUBLIC_REGISTRY_URL;
 		if (!registryBaseUrl) {
 			console.error('[auth] Missing PUBLIC_REGISTRY_URL');
-			publishAuthSessionResult(session, { status: 'error', message: 'Server not configured' });
+			publishAuthSessionResult(session, {
+				status: 'error',
+				message: 'Server not configured'
+			});
 			return json({ error: 'Server configuration error' }, { status: 500 });
 		}
 		console.info('[auth] Verifying signature', {
diff --git a/infrastructure/control-panel/src/routes/api/evaults/+server.ts b/infrastructure/control-panel/src/routes/api/evaults/+server.ts
index 49699da36..b7d864498 100644
--- a/infrastructure/control-panel/src/routes/api/evaults/+server.ts
+++ b/infrastructure/control-panel/src/routes/api/evaults/+server.ts
@@ -110,8 +110,12 @@ async function resolveVaultIdentity(
 		return {
 			type: 'user',
 			name:
-				firstNonEmptyString(userProfile.displayName, userProfile.username, vault.ename, vault.evault) ||
-				defaultName
+				firstNonEmptyString(
+					userProfile.displayName,
+					userProfile.username,
+					vault.ename,
+					vault.evault
+				) || defaultName
 		};
 	}
 
@@ -128,8 +132,7 @@ async function resolveVaultIdentity(
 					groupManifest.ename,
 					vault.ename,
 					vault.evault
-				) ||
-				defaultName
+				) || defaultName
 		};
 	}
 
diff --git a/infrastructure/control-panel/src/routes/api/notifications/send-bulk-all/+server.ts b/infrastructure/control-panel/src/routes/api/notifications/send-bulk-all/+server.ts
index cb9439707..51ebfdefa 100644
--- a/infrastructure/control-panel/src/routes/api/notifications/send-bulk-all/+server.ts
+++ b/infrastructure/control-panel/src/routes/api/notifications/send-bulk-all/+server.ts
@@ -1,9 +1,6 @@
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from '@sveltejs/kit';
-import {
-	getDevicesWithTokens,
-	sendBulkNotifications
-} from '$lib/services/notificationService';
+import { getDevicesWithTokens, sendBulkNotifications } from '$lib/services/notificationService';
 
 export const POST: RequestHandler = async ({ request }) => {
 	try {
diff --git a/infrastructure/control-panel/src/routes/api/notifications/send-bulk/+server.ts b/infrastructure/control-panel/src/routes/api/notifications/send-bulk/+server.ts
index 530b17b50..21d82a9da 100644
--- a/infrastructure/control-panel/src/routes/api/notifications/send-bulk/+server.ts
+++ b/infrastructure/control-panel/src/routes/api/notifications/send-bulk/+server.ts
@@ -8,7 +8,10 @@ export const POST: RequestHandler = async ({ request }) => {
 		const { tokens, platform, payload } = body;
 
 		if (!Array.isArray(tokens) || tokens.length === 0) {
-			return json({ success: false, error: 'tokens must be a non-empty array' }, { status: 400 });
+			return json(
+				{ success: false, error: 'tokens must be a non-empty array' },
+				{ status: 400 }
+			);
 		}
 		if (!payload?.title || !payload?.body) {
 			return json(
diff --git a/infrastructure/control-panel/src/routes/api/notifications/send-by-ename/+server.ts b/infrastructure/control-panel/src/routes/api/notifications/send-by-ename/+server.ts
index 81e0d2d2f..fd54f9754 100644
--- a/infrastructure/control-panel/src/routes/api/notifications/send-by-ename/+server.ts
+++ b/infrastructure/control-panel/src/routes/api/notifications/send-by-ename/+server.ts
@@ -1,9 +1,6 @@
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from '@sveltejs/kit';
-import {
-	getDevicesByEName,
-	sendBulkNotifications
-} from '$lib/services/notificationService';
+import { getDevicesByEName, sendBulkNotifications } from '$lib/services/notificationService';
 
 export const POST: RequestHandler = async ({ request }) => {
 	try {
@@ -11,10 +8,7 @@ export const POST: RequestHandler = async ({ request }) => {
 		const { eName, payload } = body;
 
 		if (!eName || typeof eName !== 'string' || !eName.trim()) {
-			return json(
-				{ success: false, error: 'Missing or invalid eName' },
-				{ status: 400 }
-			);
+			return json({ success: false, error: 'Missing or invalid eName' }, { status: 400 });
 		}
 		if (!payload?.title || !payload?.body) {
 			return json(
diff --git a/infrastructure/control-panel/src/routes/login/+page.svelte b/infrastructure/control-panel/src/routes/login/+page.svelte
index 2bf245b2e..3961c96a4 100644
--- a/infrastructure/control-panel/src/routes/login/+page.svelte
+++ b/infrastructure/control-panel/src/routes/login/+page.svelte
@@ -129,8 +129,8 @@
 	<div class="w-full rounded-xl border border-gray-200 bg-white p-8 shadow-sm">
 		<h1 class="text-2xl font-semibold text-gray-900">Control Panel Login</h1>
 		<p class="mt-2 text-sm text-gray-600">
-			Authenticate with your eID Wallet. Only admin eNames in the server allowlist can access this
-			panel.
+			Authenticate with your eID Wallet. Only admin eNames in the server allowlist can access
+			this panel.
 		</p>
 
 		{#if error}
@@ -155,7 +155,11 @@
 						Tap to open the wallet app and complete authentication.
 					</p>
 				{:else}
-					<img src={qrDataUrl} alt="W3DS auth QR code" class="h-64 w-64 rounded-lg bg-white p-2" />
+					<img
+						src={qrDataUrl}
+						alt="W3DS auth QR code"
+						class="h-64 w-64 rounded-lg bg-white p-2"
+					/>
 					<p class="text-center text-sm text-gray-600">
 						Scan this QR code with your eID Wallet app.
 					</p>
diff --git a/infrastructure/control-panel/src/routes/monitoring/+page.svelte b/infrastructure/control-panel/src/routes/monitoring/+page.svelte
index 0ec566d75..563d980ae 100644
--- a/infrastructure/control-panel/src/routes/monitoring/+page.svelte
+++ b/infrastructure/control-panel/src/routes/monitoring/+page.svelte
@@ -654,7 +654,9 @@
 	</div>
 {:else}
 	<section class="flex h-[calc(100vh-180px)] w-full min-w-0 gap-4">
-		<div class="bg-gray flex min-w-0 flex-1 flex-col overflow-hidden rounded-lg border border-gray-200">
+		<div
+			class="bg-gray flex min-w-0 flex-1 flex-col overflow-hidden rounded-lg border border-gray-200"
+		>
 			<div class="z-10 flex w-full items-center justify-between bg-white p-4">
 				<div>
 					<h4 class="text-xl font-semibold text-gray-800">Live Monitoring</h4>
diff --git a/infrastructure/control-panel/src/routes/notifications/+page.svelte b/infrastructure/control-panel/src/routes/notifications/+page.svelte
index 2e3c74c90..cac609267 100644
--- a/infrastructure/control-panel/src/routes/notifications/+page.svelte
+++ b/infrastructure/control-panel/src/routes/notifications/+page.svelte
@@ -343,7 +343,9 @@
 		</p>
 		{#if deviceCount !== null}
 			<p class="text-black-500 mt-1 text-sm font-medium">
-				{deviceCount} device{deviceCount === 1 ? '' : 's'} with push token{deviceCount === 1 ? '' : 's'}
+				{deviceCount} device{deviceCount === 1 ? '' : 's'} with push token{deviceCount === 1
+					? ''
+					: 's'}
 			</p>
 		{/if}
 		<div class="mt-4 space-y-4">
diff --git a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
index ce0fb3bdd..56dedab62 100644
--- a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
+++ b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
@@ -709,7 +709,10 @@ export function createScanLogic({
             // Single write: signer creates the doc in the REQUESTER's vault.
             // subject=@requester, data.name=requesterName, ownerSig=@signer.
             // The requester polls their own vault, finds it, and counter-signs it there.
-            const parties: [string, string] = [signerEname, normalizedRequesterEname];
+            const parties: [string, string] = [
+                signerEname,
+                normalizedRequesterEname,
+            ];
             const relationDescription = get(socialBindingRelationDescription);
             const doc = {
                 subject: requesterEname,

From 1f23e62cbcb2c48219277b01da563678eafb9547 Mon Sep 17 00:00:00 2001
From: coodos <me@merul.org>
Date: Tue, 10 Mar 2026 22:20:20 +0530
Subject: [PATCH 3/4] chore: fix code rabbit suggestions

---
 .../eid-wallet/src/lib/utils/socialBinding.ts |  2 +-
 .../src/routes/(app)/ePassport/+page.svelte   |  2 +-
 .../src/routes/(app)/scan-qr/scanLogic.ts     |  1 +
 .../services/BindingDocumentService.spec.ts   | 56 +++++++++++++++++++
 .../src/services/BindingDocumentService.ts    | 14 +++--
 .../ontology/schemas/binding-document.json    |  2 +-
 6 files changed, 68 insertions(+), 9 deletions(-)

diff --git a/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts b/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
index fa84bc91f..692e9112c 100644
--- a/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
+++ b/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
@@ -315,7 +315,7 @@ export async function createSocialConnectionDoc(
                 data: {
                     kind: "social_connection",
                     name: subjectName,
-                    parties,
+                    parties: parties.map((p) => (p.startsWith("@") ? p : `@${p}`)) as [string, string],
                     relation_description: relationDescription,
                 },
                 ownerSignature: {
diff --git a/infrastructure/eid-wallet/src/routes/(app)/ePassport/+page.svelte b/infrastructure/eid-wallet/src/routes/(app)/ePassport/+page.svelte
index 25405704b..eebf26086 100644
--- a/infrastructure/eid-wallet/src/routes/(app)/ePassport/+page.svelte
+++ b/infrastructure/eid-wallet/src/routes/(app)/ePassport/+page.svelte
@@ -733,7 +733,7 @@ onMount(async () => {
                     </p>
                 {/if}
             </div>
-            {#if socialBindingPendingDocParsed?.data?.relation_description}
+            {#if typeof socialBindingPendingDocParsed?.data?.relation_description === "string" && socialBindingPendingDocParsed.data.relation_description}
                 <div class="bg-gray rounded-2xl p-4 flex flex-col gap-1">
                     <p class="small text-black-500">Relationship Description</p>
                     <p class="text-sm text-black-700">
diff --git a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
index 56dedab62..0d7c529e9 100644
--- a/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
+++ b/infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
@@ -633,6 +633,7 @@ export function createScanLogic({
             socialBindingRequesterName.set(null);
             socialBindingError.set(null);
             socialBindingSuccess.set(false);
+            socialBindingRelationDescription.set("");
             socialBindingDrawerOpen.set(true);
 
             // Fetch the requester's display name eagerly so the drawer shows it immediately.
diff --git a/infrastructure/evault-core/src/services/BindingDocumentService.spec.ts b/infrastructure/evault-core/src/services/BindingDocumentService.spec.ts
index bf32ee6b9..8b12e406a 100644
--- a/infrastructure/evault-core/src/services/BindingDocumentService.spec.ts
+++ b/infrastructure/evault-core/src/services/BindingDocumentService.spec.ts
@@ -116,6 +116,62 @@ describe("BindingDocumentService (integration)", () => {
             });
         });
 
+        it("should reject social_connection with malformed parties", async () => {
+            const cases = [
+                { parties: "not-an-array", label: "string instead of array" },
+                { parties: ["@only-one"], label: "array of 1" },
+                { parties: ["@a", "@b", "@c"], label: "array of 3" },
+                { parties: ["no-at", "@valid"], label: "missing @ prefix" },
+                { parties: ["@same", "@same"], label: "duplicate eNames" },
+            ];
+
+            for (const { parties, label } of cases) {
+                const data = { kind: "social_connection", name: "Test", parties, relation_description: "desc" } as any;
+                await expect(
+                    bindingDocumentService.createBindingDocument(
+                        {
+                            subject: "test-user-123",
+                            type: "social_connection",
+                            data,
+                            ownerSignature: {
+                                signer: TEST_ENAME,
+                                signature: "dummy-hash",
+                                timestamp: new Date().toISOString(),
+                            },
+                        },
+                        TEST_ENAME,
+                    ),
+                ).rejects.toThrow("social_connection data must have parties");
+            }
+        });
+
+        it("should reject social_connection with missing or non-string relation_description", async () => {
+            const cases = [
+                { relation_description: undefined, label: "missing" },
+                { relation_description: 42, label: "number" },
+                { relation_description: { nested: true }, label: "object" },
+            ];
+
+            for (const { relation_description, label } of cases) {
+                const data = { kind: "social_connection", name: "Test", parties: ["@a", "@b"], relation_description } as any;
+                await expect(
+                    bindingDocumentService.createBindingDocument(
+                        {
+                            subject: "test-user-123",
+                            type: "social_connection",
+                            data,
+                            ownerSignature: {
+                                signer: TEST_ENAME,
+                                signature: "dummy-hash",
+                                timestamp: new Date().toISOString(),
+                            },
+                        },
+                        TEST_ENAME,
+                    ),
+                ).rejects.toThrow("social_connection data must have string field: relation_description");
+            }
+        });
+
         it("should create a binding document with self type", async () => {
             const data = { kind: "self" as const, name: "Bob Jones" };
             const result = await bindingDocumentService.createBindingDocument(
diff --git a/infrastructure/evault-core/src/services/BindingDocumentService.ts b/infrastructure/evault-core/src/services/BindingDocumentService.ts
index e0f84cda7..6bac1cf06 100644
--- a/infrastructure/evault-core/src/services/BindingDocumentService.ts
+++ b/infrastructure/evault-core/src/services/BindingDocumentService.ts
@@ -63,15 +63,17 @@ function validateBindingDocumentData(
                     'social_connection data must have string field: name',
                 );
             }
+            const denseParties = Array.isArray(d.parties) ? Array.from(d.parties) : null;
             if (
-                !Array.isArray(d.parties) ||
-                d.parties.length !== 2 ||
-                !d.parties.every(
+                !denseParties ||
+                denseParties.length !== 2 ||
+                !denseParties.every(
                     (p: unknown) => typeof p === "string" && (p as string).startsWith("@"),
-                )
+                ) ||
+                denseParties[0] === denseParties[1]
             ) {
                 throw new ValidationError(
-                    'social_connection data must have parties: array of 2 eNames prefixed with @',
+                    'social_connection data must have parties: array of 2 distinct eNames prefixed with @',
                 );
             }
             if (typeof d.relation_description !== "string") {
@@ -82,7 +84,7 @@ function validateBindingDocumentData(
             return {
                 kind: "social_connection",
                 name: d.name,
-                parties: d.parties as [string, string],
+                parties: denseParties as [string, string],
                 relation_description: d.relation_description as string,
             } as BindingDocumentSocialConnectionData;
         }
diff --git a/services/ontology/schemas/binding-document.json b/services/ontology/schemas/binding-document.json
index 5450b6001..81995edf2 100644
--- a/services/ontology/schemas/binding-document.json
+++ b/services/ontology/schemas/binding-document.json
@@ -108,7 +108,7 @@
                 },
                 "parties": {
                     "type": "array",
-                    "items": { "type": "string" },
+                    "items": { "type": "string", "pattern": "^@[^\\s]+$" },
                     "minItems": 2,
                     "maxItems": 2,
                     "description": "eNames of both participants"

From f7762cabc5ef7e21f349e482dc08a40da7c7b529 Mon Sep 17 00:00:00 2001
From: coodos <me@merul.org>
Date: Tue, 10 Mar 2026 22:43:28 +0530
Subject: [PATCH 4/4] chore: format

---
 .../control-panel/config/admin-enames.json         | 14 +++++++-------
 .../eid-wallet/src/lib/utils/socialBinding.ts      |  4 +++-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/infrastructure/control-panel/config/admin-enames.json b/infrastructure/control-panel/config/admin-enames.json
index 707fe51fa..1827d693c 100644
--- a/infrastructure/control-panel/config/admin-enames.json
+++ b/infrastructure/control-panel/config/admin-enames.json
@@ -1,9 +1,9 @@
 {
-    "admins": [
-        "@7218b67d-da21-54d6-9a85-7c4db1d09768",
-        "@82f7a77a-f03a-52aa-88fc-1b1e488ad498",
-        "@35a31f0d-dd76-5780-b383-29f219fcae99",
-        "@82f7a77a-f03a-52aa-88fc-1b1e488ad498",
-        "@af7e4f55-ad9d-537c-81ef-4f3a234bdd2c"
-    ]
+	"admins": [
+		"@7218b67d-da21-54d6-9a85-7c4db1d09768",
+		"@82f7a77a-f03a-52aa-88fc-1b1e488ad498",
+		"@35a31f0d-dd76-5780-b383-29f219fcae99",
+		"@82f7a77a-f03a-52aa-88fc-1b1e488ad498",
+		"@af7e4f55-ad9d-537c-81ef-4f3a234bdd2c"
+	]
 }
diff --git a/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts b/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
index 692e9112c..c99d85ffe 100644
--- a/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
+++ b/infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
@@ -315,7 +315,9 @@ export async function createSocialConnectionDoc(
                 data: {
                     kind: "social_connection",
                     name: subjectName,
-                    parties: parties.map((p) => (p.startsWith("@") ? p : `@${p}`)) as [string, string],
+                    parties: parties.map((p) =>
+                        p.startsWith("@") ? p : `@${p}`,
+                    ) as [string, string],
                     relation_description: relationDescription,
                 },
                 ownerSignature: {