docs: record the IH conformance fixes in the DCP test plan

[paullatzelsperger]

Follows #18. eclipse-edc/IdentityHub#1063 closes nine of the cases this plan had open, so the IH column moves to 2 ❌, 3 ⚠️ from 5 and 9.

Those rows are green with their Notes naming the pull request, and the legend says so, so they can be read back to amber if it does not land.

Closed by that PR

Case	Was	What was wrong
CS-STOR-05, RT-03	❌	The REJECTED CredentialMessage path did not exist on either side: the Issuer only ever sent status: ISSUED, and the holder acknowledged a rejection with a 200 and then left the request waiting.
CS-PRES-11	⚠️	The vc.id scope alias is a spec MUST and was unimplemented; the scope tokenizer rejected it as malformed.
IS-META-02	❌	credentialSchema was absent from the model, the transformers and the vendored JSON-LD context, which had drifted behind the published one. issuancePolicy also carried a fresh UUID per request, so cached objects differed between fetches.
IS-OFF-03	⚠️	Offers reused the metadata objects verbatim, so every offer claimed reissue.
CS-PRES-12, CS-PRES-13	⚠️	Filtering was already correct but only ever covered one condition at a time. The VP side was not: see below.
TOK-09, TOK-11	⚠️	Handled by the upstream key resolver; the fix makes that answer binding rather than advisory.

Two findings worth the DIV assessment's attention

Neither was a gap this plan had identified. Both are recorded in §9 because a BYOW Credential Service can get them wrong the same way:

• The holder's Storage and Offer APIs resolved a signing key from the DID named in the token's kid header while identifying the sender by its iss claim, with nothing binding the two. Any holder of a resolvable DID could sign a CredentialMessage claiming to come from a trusted issuer — the trusted-issuer check compares against iss, so it passed.
• Published DID documents declared no verification relationships at all, so no generated Verifiable Presentation satisfied §5.4.3's requirement that its signing key be declared for authentication.

Worth asking whether DIV binds kid to iss, and what its DID documents declare.

Status changes that are not fixes

• TOK-10 stays ⚠️ but the note changes from unknown to blocked: the upstream DidDocument model has no capabilityInvocation property, so IH can neither publish nor enforce the relationship. This is a Connector-level gap, and it may be worth confirming whether any implementation in the ecosystem enforces the requirement today.
• RT-06's note now records that the key-rotation e2e exists but is disabled pending its own runtime.
• CS-STOR-14 and IS-REQ-08 remain ❌, and TOK-13 remains unverified on three of five endpoints.

The Priorities lists are untouched — they describe enhanced tests the TCK still needs, which IH's implementation status does not change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QXL1LjCxfNnVtKkQFShci9