# Corrections

Corrections to published snapshots in this directory. The snapshot files
themselves are left byte-identical to what was published, so existing citations
keep resolving to the bytes they referenced.

## 2026-08-13: `legal_basis` locator in the archived snapshots

The `legal_basis` block in `data/audit-2026-06-25.json` and
`data/audit-2026-07-08.json` cites the ARF requirement locator `RPRC_07` for the
registered-versus-requested boundary. That locator is incorrect. The correct
locator is `RPRC_21`, the requirement that a Wallet Unit verifies that all
attributes requested in a presentation request are included in the list of
attributes in the registration certificate, and warns the User otherwise.

The label was already incorrect when those snapshots were published. `RPRC_07`
has concerned the EU-wide unique identifier for the subject of the registration
certificate (the relying-party identifier) since at least ARF 2.8.0, and
`RPRC_21` already covered the boundary check in ARF 2.8.0 and 2.9.0. Verified
against the Annex 2 high-level requirements at tags `v2.8.0`, `v2.9.0`, and
`main`:
https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework/blob/main/hltr/high-level-requirements.csv
(access 2026-08-13).

`data/audit.json` and the generator that produces it
(`verifier_core::inspector::LEGAL_BASIS`, consumed by `backend/src/audit.rs`)
are corrected and now carry `RPRC_21`. In the two archived snapshots, read the
locator as `RPRC_21`.